Is CVE-2026-111215 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111215?

CVE-2026-111215 has a CVSS v3 severity of HIGH (7.2).

Back

CVE-2026-111215

Description

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.