CVE Alert: CVE-2026-111231 – Netgate

Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the ‘User – Config: Deny Config Write’ privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.

**Risk verdict:** High risk for internet- or partner-reachable firewall management interfaces; prioritise review now, while noting that exploitation status and prevalence are unconfirmed.

**Why this matters:** A compromised privileged account could turn a nominally read-only role into control over the appliance’s configuration and enable root-level execution. An attacker could alter filtering, routing, DNS or VPN settings, disrupt connectivity, or use the firewall’s trusted network position to support further intrusion. A proof-of-concept reference is present, but there is no KEV, SSVC or EPSS data here to establish exploitation activity or likelihood.

**Most likely attack path:** The attacker needs network access to the management interface and an account with the relevant page privileges; no additional user action or unusual conditions are indicated. They exploit the restore/install workflow to replace the configuration, then wait for or trigger a reload or reboot. Direct impact is on the firewall; changed network controls could nevertheless enable access to internal systems.

**Who is most exposed:** Organisations permitting remote WebGUI access, especially where lower-privilege accounts can reach configuration or backup pages. Internet-facing management and shared administrator accounts increase exposure.

Review WebGUI authentication and access logs for restore, upload or backup-page activity by non-admin accounts.

Alert on unexpected configuration replacement, restore events, or configuration hash changes.

Check for unplanned reloads, reboots, new accounts, firewall rules, routes or VPN settings.

Mitigation and prioritisation:

Confirm the vendor’s fixed release and upgrade promptly; the supplied data does not identify one.

Restrict WebGUI access to trusted management networks and remove unnecessary page privileges.

Rotate credentials for potentially exposed accounts; review recent configuration changes.

Preserve logs and a known-good configuration before controlled upgrade and validation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.