pfSense vulnerabilities
We track 15 vulnerabilities in pfSense products across 3 products. 15 are rated high or critical, and none are known to be exploited. The most recent was published on October 15, 2026.
Latest pfSense vulnerabilities
- 8.8 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prep
- 7.2 High severity
pfSense CE: Improper Neutralization of CRLF Sequences
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metach
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a g
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments pri
- 7.2 High severity
pfSense CE: Improper Neutralization of Special Elements used in an OS Command
Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit t
- 9.9 Critical severity
Pfsense: Improper Access Control
Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.
- 9.1 Critical severity
Pfsense: Deserialization of Untrusted Data
Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and t
- 9.8 Critical severity
Pfsense Plus: Improper Restriction of Excessive Authentication Attempts
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.
- 9.8 Critical severity
Pfblockerng: Improper Neutralization of Special Elements used in an OS Command
pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814.
- 8.8 High severity
pfSense CE and pfSense Plus: Improper Limitation of a Pathname to a Restricted Directory
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing file
- 8.8 High severity
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software…
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to ex