---
id: CVE-2026-111214
title: >-
  Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection
  vulnerability that allows authenticated users with QinQ edit privilege to run
  commands by storing an unvalidated parent interface name
summary: >-
  Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection
  vulnerability that allows authenticated users with QinQ edit privilege to run
  commands by storing an unvalidated parent interface name. Attackers can save a
  crafted …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: Netgate
product: pfSense CE
affected:
  - pfsense_ce >= 2.7.0 <= 2.9.0
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:17:33.603'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-111214'
references:
  - url: 'https://abraxaslabs.tech/research/pfsense-ce-leftovers'
    label: disclosure@vulncheck.com
  - url: 'https://abraxaslabs.tech/research/pfsense-qinq-parent-if'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/abraxas/pfsense-qinq-parent-if'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/interfaces.inc#L620
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L136
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/interfaces_qinq_edit.php#L212
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netgate-pfsense-ce-2.7.0-through-2.9.0-os-command-injection-via-interfaces-qinq-edit-php
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-15T19:25:46.426Z'
---

## Overview

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.