Is CVE-2026-111221 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111221?

CVE-2026-111221 has a CVSS v3 severity of MEDIUM (6.6).

Back

CVE-2026-111221

Description

Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.