CVE-2026-111219

Estado: AnalizadaAlta (7.5)—

Gravedad7.5Alta · CVSS 4.0

Probabilidad de explotación0.89 %mayor que el 59 % de las CVE

Explotación activaNono figura en el catálogo de CISA

Exploit públicoNo conocidosin código público localizado

Netgate pfSense CE hasta la versión 2.9.0 incluida contiene una vulnerabilidad de inyección de nuevas líneas en services_pppoe_edit.php que permite a los usuarios con privilegios inyectar entradas mpd.secret mediante campos POST de nombre de usuario no validados. Los atacantes con el privilegio PPPoE Server Edit pueden añadir una línea cuyo secreto comience por '!', lo que hace que mpd5 ejecute comandos como root cuando un cliente PPPoE se autentica.

Traducción automática del texto original de NVD (en inglés).

CVSS

Puntuación base: 7.5
Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.89 %
Percentil entre todas las CVEs puntuadas: 59
Fecha de la puntuación: 20/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1059 Command and Scripting Interpreterexecution80 %
Impacto secundarioT1068 Exploitation for Privilege Escalationprivilege escalation55 %

Vector AV:N/PR:H/UI:N implica red con privilegios (T1210); el texto indica inyección en mpd.secret que ejecuta comandos como root al autenticarse un cliente PPPoE.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence Program Privileged Account Management Execution Prevention Disable or Remove Feature or Program Application Isolation and Sandboxing Exploit Protection

Tecnologías afectadas (1)

Pfsense — Pfsense

CWE

CWE-93

Referencias

Mostrar las 5 referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-111219",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-111219",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-16T16:29:14.127629Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "repo": "https://github.com/pfsense/pfsense",
          "vendor": "Netgate",
          "product": "pfSense CE",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "2.9.0"
            }
          ],
          "packageURL": "pkg:github/pfsense/pfsense",
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-15T19:17:34.357",
  "references": [
    {
      "url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers",
      "tags": [
        "Issue Tracking"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/abraxas/pfsense-pppoe-secret-bang",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/vpn.inc#L272-L282",
      "tags": [
        "Product"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/www/services_pppoe_edit.php#L141-L152",
      "tags": [
        "Product"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-command-injection-via-pppoe-server-username",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-93"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates."
    }
  ],
  "lastModified": "2026-10-20T15:37:57.990",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACC83500-4384-43A6-90F9-86FF7808BD18",
              "versionEndIncluding": "2.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}