csaf_bsi_white:wid-sec-w-2026-3983
csaf_bsi_white
Description
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen und um auf Dateien zuzugreifen.
Timeline
- Published
- 2026-10-15 22:00 UTC
- Last Modified
- 2026-10-15
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
},
{
"category": "description",
"text": "pfSense ist eine Software-Edge-Firewall mit Router- und VPN-Funktionalität.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Netgate pfSense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen und um auf Dateien zuzugreifen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Appliance\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt für Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-3983 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3983.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-3983 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3983"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-c3v6-7g6h-r7q8"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-3vw7-4qg6-g75v"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-3pxq-gxxr-7p9c"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-hvrf-cf2c-3rqh"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-xf3x-9wqm-925c"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-prh2-rh73-jcp7"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-fffm-6286-c3r5"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-743j-3p3m-6h73"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-3c6h-8mvp-vqx3"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-cx43-pf3x-hc6x"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-28v9-q2x4-wjw8"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-fm76-5wvr-6cv2"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-224g-fpr5-96gw"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-gg6q-95gx-p8r8"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-j7pj-3cmw-7qqc"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-4m9r-jxrh-x66q"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-643j-4p8v-85c8"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-x2xf-vqvc-49xv"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-5w5g-f2w6-c5hp"
},
{
"category": "external",
"summary": "GitHub Advisory Database vom 2026-10-15",
"url": "https://github.com/advisories/GHSA-qcp6-4768-v6qq"
},
{
"category": "external",
"summary": "Abraxas Labs \"pfSense CE leftovers\" vom 2026-10-15",
"url": "https://abraxaslabs.tech/research/pfsense-ce-leftovers"
}
],
"source_lang": "en-US",
"title": "Netgate pfSense: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-10-15T22:00:00.000+00:00",
"generator": {
"date": "2026-10-16T10:35:55.216+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-3983",
"initial_release_date": "2026-10-15T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-10-15T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "<=2.9.0",
"product": {
"name": "Netgate pfSense <=2.9.0",
"product_id": "T059627"
}
},
{
"category": "product_version_range",
"name": "<=2.9.0",
"product": {
"name": "Netgate pfSense <=2.9.0",
"product_id": "T059627-fixed"
}
}
],
"category": "product_name",
"name": "pfSense"
}
],
"category": "vendor",
"name": "Netgate"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-111214",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111214"
},
{
"cve": "CVE-2026-111215",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111215"
},
{
"cve": "CVE-2026-111216",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111216"
},
{
"cve": "CVE-2026-111217",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111217"
},
{
"cve": "CVE-2026-111218",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111218"
},
{
"cve": "CVE-2026-111219",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111219"
},
{
"cve": "CVE-2026-111220",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111220"
},
{
"cve": "CVE-2026-111221",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111221"
},
{
"cve": "CVE-2026-111222",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111222"
},
{
"cve": "CVE-2026-111223",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111223"
},
{
"cve": "CVE-2026-111224",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111224"
},
{
"cve": "CVE-2026-111225",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111225"
},
{
"cve": "CVE-2026-111226",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111226"
},
{
"cve": "CVE-2026-111227",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111227"
},
{
"cve": "CVE-2026-111228",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111228"
},
{
"cve": "CVE-2026-111229",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111229"
},
{
"cve": "CVE-2026-111230",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111230"
},
{
"cve": "CVE-2026-111231",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111231"
},
{
"cve": "CVE-2026-111232",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111232"
},
{
"cve": "CVE-2026-111233",
"product_status": {
"last_affected": [
"T059627"
]
},
"release_date": "2026-10-15T22:00:00.000+00:00",
"title": "CVE-2026-111233"
}
]
}