{"id":"CVE-2026-110908","title":"Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter","summary":"Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a f…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T03:17:10.797","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110908","references":[{"url":"https://github.com/pfsense/FreeBSD-ports/blob/a621624266b19a7f48b1f94a60821d2c2fc6ee4c/net/pfSense-pkg-frr/files/usr/local/www/status_frr.php#L62-L73","label":"cve@mitre.org"},{"url":"https://redmine.pfsense.org/issues/17134","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-15T03:30:12.928Z","vendor":"Netgate","product":"pfSense-pkg-frr","affected":["pfSense-pkg-frr 2.0.2_1","pfSense-pkg-frr 2.1.2_1"],"slug":"CVE-2026-110908","body":"## Overview\n\nNetgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}