CVE-2026-111220

{
  "etk_id": "ETK-2026-1716",
  "cve_id": "CVE-2026-111220",
  "display_id": "CVE-2026-111220",
  "ghsa_id": "GHSA-cx43-pf3x-hc6x",
  "euvd_id": "EUVD-2026-102332",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cron schedule injection in pfSense CE PPP configuration",
  "summary": "pfSense CE through 2.9.0 is affected by an input-handling flaw in PPP configuration management that can create unintended scheduled tasks. An authenticated user with permission to edit PPP interfaces may use it to cause commands to run as root.",
  "mitigation": "Immediately remove the PPP interface editing privilege from accounts that do not require it and limit administrative access to trusted operators. Review cron entries and PPP configuration for unexpected changes, and apply a vendor update when a fixed release is confirmed.",
  "vendor": "Netgate",
  "product": "pfSense CE",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.9.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "pfSense CE",
      "purl": null
    }
  ],
  "cwes": [
    93
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0073,
  "epss_percentile": 0.5333,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.48001215,
  "t0_at": "2026-10-15T18:46:21.230000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-15T20:09:19.903794+00:00",
      "days": 0.057623539282407404,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T18:46:21.230000+00:00",
      "url": "https://github.com/abraxas/pfsense-pppoe-cron"
    },
    "trigger_signal": {
      "at": "2026-10-15T18:46:21.230000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T18:46:21.230000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111220"
    }
  }
}