Netgate patches high-severity command injection in pfSense FRR package

Netgate has released updated packages to address a high-severity command injection flaw in its pfSense firewall software. The vulnerability, tracked as CVE-2026-110908, affects the FRR routing package and allows authenticated users to execute arbitrary commands with root privileges.

What happened

The National Vulnerability Database records CVE-2026-110908 as a high-severity issue with a CVSS score of 8.8. The flaw resides in the pfSense-pkg-frr package, specifically in versions 2.0.2_1 and source revision 2.1.2_1. The vulnerability is an OS command injection weakness, classified under CWE-78, located within the FRR status filter functionality of the WebGUI interface.

An attacker does not need full administrative access to exploit this issue. According to the NVD record, an authenticated WebGUI user possessing only the page-status-frr privilege can trigger the vulnerability. By supplying a crafted filter value, the user can break out of a single-quoted sed expression. This expression incorporates output from the escapeshellarg() function, allowing the injection to bypass intended protections.

Once the injection occurs, shell command substitution is evaluated by a popen() pipeline. This mechanism allows the attacker to execute commands of their choosing. Because the process runs with elevated privileges, the injected commands execute as root on the affected system. This grants the attacker complete control over the firewall appliance.

Why it matters

This vulnerability is significant because it lowers the barrier for exploitation. Attackers do not need to compromise an administrator account; a lower-privileged user with specific page access is sufficient. The ability to execute commands as root means an attacker can potentially install malware, exfiltrate data, or pivot to other network segments.

The affected versions, 2.0.2_1 and 2.1.2_1, are specific builds of the FRR package used in Netgate’s pfSense ecosystem. Organizations relying on these versions for routing status monitoring are exposed until they apply the vendor’s updates. The high CVSS score reflects the severity of remote code execution with root privileges.

What to watch

• Check if your pfSense instance runs pfSense-pkg-frr version 2.0.2_1 or 2.1.2_1.
• Verify that no users with page-status-frr privilege are accessing the WebGUI from untrusted networks.
• Monitor system logs for unexpected command executions or shell activity following filter usage.
• Confirm that updated packages have been successfully installed on all affected appliances.

Who needs to act first

Teams should prioritize updating systems that are exposed to the internet or accessible to semi-trusted users. Since the flaw requires authentication, internal systems with strict access controls are at lower immediate risk, but remediation should still proceed. Before applying updates, create a full system backup to ensure rollback capability. Test the update in a non-production environment first to verify routing stability. If immediate patching is not possible, restrict access to the WebGUI for accounts with the page-status-frr privilege.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Netgate

• Audit user accounts to identify any with the page-status-frr privilege and review their activity.
• Download and install the updated FRR packages for pfSense Plus 26.07/26.03.1 or CE 2.9.0/2.8.1.
• Verify that the installed package version is no longer 2.0.2_1 or 2.1.2_1 after the update.
• Review system logs for signs of exploitation, such as unusual command executions, prior to patching.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific pfSense versions are affected by CVE-2026-110908?

The vulnerability affects pfSense-pkg-frr versions 2.0.2_1 and source revision 2.1.2_1.

Is a fix available for this vulnerability?

Yes, Netgate has released updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.

What privileges are required to exploit this flaw?

An attacker needs an authenticated WebGUI account with the page-status-frr privilege.