Netgate Pfsense Ce Through 2.9.0 Authorization Bypass Via Config Restore And Config Install

Back www.vulncheck.com

Netgate Pfsense Ce Through 2.9.0 Authorization Bypass Via Config Restore And Config Install

www.vulncheck.com • October 16, 2026

Share: View original

Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()

CWE-863 Incorrect Authorization

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk Authorization Bypass in Netgate pfSense CE Netgate pfSense CE versions up to 2.9.0 contain an authorization bypass vulnerability (CVE-2026-111231) that allows read-only WebGUI users to replace the config.xml file. This flaw arises because the config_restore() and config_install() functions ignore the 'User – Config: Deny Config Write' privilege. Attackers with access to specific pages can exploit this to gain root-level code execution upon a system reload or reboot. Organizations with internet-reachable firewall management interfaces are particularly at risk. The vulnerability has a CVSS score of 8.6, indicating high severity, but there is currently no confirmed exploitation in the wild. Administrators are advised to review WebGUI access logs and restrict access to trusted networks while awaiting a vendor patch. 1 sources 62

Extracted Entities

Attack Types (1)

Zero-day Exploit

CWE Weaknesses (1)

CWE-863 - Incorrect Authorization

Platforms (1)