Is CVE-2026-111230 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111230?

CVE-2026-111230 has a CVSS v3 severity of MEDIUM (4.9).

Back

CVE-2026-111230

Description

Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.