Medium severity5.0NVD Advisory· Published Oct 15, 2026· Updated Oct 15, 2026

CVE-2026-111225

Description

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Netgate/Pfsense Cellm-fuzzy
Range: 2.5.0 through 2.9.0

Patches

Vulnerability mechanics

References

abraxaslabs.tech/research/pfsense-ce-leftoversnvd
github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/usr/local/sbin/openvpn.learn-address.shnvd
www.vulncheck.com/advisories/netgate-pfsense-ce-2.5.0-through-2.9.0-os-command-injection-via-openvpn-learn-address-shnvd

News mentions

No linked articles in our index yet.

cvss	0.325
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000