CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid
Authenticated users with PPP edit privileges can inject commands into crontab to execute arbitrary code as root on pfSense CE.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111220?
CVE-2026-111220 is a high-severity command injection vulnerability in Netgate pfSense CE, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
Weakness: CWE-93
Which versions are affected by CVE-2026-111220?
How do I fix CVE-2026-111220?
No fix has been published for CVE-2026-111220 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-111220 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111220 exists.
Sources
Also known as GHSA-cx43-pf3x-hc6x.