HIGHCVSS v3.1 7.5Vulnerability

CVE-2026-111224

pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.

Properties

Severity
HIGH
Nvd fetched at
2026-10-20T21:14:08.448323+00:00
Epss score
0.05366
Cvss severity
HIGH
Cvss score
7.5
Retrieved at
2026-10-21T01:24:48+00:00
Last source
FIRST EPSS
Score
7.5
Cvss version
3.1
Cve id
CVE-2026-111224
Cvss vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
First seen by Signal
2026-10-18T13:39:03+00:00
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Published at
2026-10-15T19:17:35.090
Last modified
2026-10-16T18:17:36.877
Epss percentile
0.92578

Related Entities (1)

HAS_WEAKNESS (1)

→[Weakness]Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Explore deeper with Ninja Signal's threat intelligence graph

Search in SpektrOpen Signal Desktop
CVE-2026-111224 (CVSS v3.1 7.5) — Ninja Signal Threat Intelligence | Ninja Signal