---
id: CVE-2026-110908
title: >-
  Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision
  2.1.2_1 contain an OS command injection vulnerability in the FRR status filter
summary: >-
  Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision
  2.1.2_1 contain an OS command injection vulnerability in the FRR status
  filter. An authenticated WebGUI user with only the page-status-frr privilege
  can supply a f…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: Netgate
product: pfSense-pkg-frr
affected:
  - pfSense-pkg-frr 2.0.2_1
  - pfSense-pkg-frr 2.1.2_1
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T16:17:48.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-110908'
references:
  - url: >-
      https://github.com/pfsense/FreeBSD-ports/blob/a621624266b19a7f48b1f94a60821d2c2fc6ee4c/net/pfSense-pkg-frr/files/usr/local/www/status_frr.php#L62-L73
    label: cve@mitre.org
  - url: 'https://redmine.pfsense.org/issues/17134'
    label: cve@mitre.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-15T15:43:20.464338Z'
ingestedAt: '2026-10-15T03:30:12.928Z'
---

## Overview

Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.