CVE-2021-41282: pfSense diag_routes.php sed injection allows arbitrary file write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with high confidentiality, integrity and availability impact, public exploit references, and a very high EPSS score, though it requires authenticated access and is not in KEV.

What it is

diag_routes.php in pfSense 2.5.2 passes netstat output through sed without preventing sed-specific code injection, even though escapeshellarg is used on arguments. An authenticated user who is only meant to view route data can inject sed commands and write an arbitrary file to an arbitrary location. This matters because it turns a low-privilege read-only feature into a file-write primitive on the firewall.

Impact

An attacker gains the ability to write arbitrary files anywhere on the pfSense host, which can be leveraged to achieve shell upload and remote command execution. This compromises the confidentiality, integrity and availability of the firewall.

Attack surface

Reached over the network through the pfSense web interface at diag_routes.php; the CVSS vector shows PR:L, so a valid authenticated session is required, and UI:N means no user interaction beyond the attacker's own requests.

Exploitation

CISA KEV does not list it, but EPSS is very high (0.87113, 99.7th percentile) and multiple references are tagged Exploit, including a Packet Storm shell upload and a Shielder advisory, indicating public exploit code exists.

What to do

• Upgrade pfSense to 2.6.0 or the 22-01 release, which the vendor release notes identify as containing the fix.
• If immediate upgrade is not possible, restrict access to diag_routes.php and the web GUI to trusted administrative networks only.
• Audit and reduce the number of accounts with GUI access, and enforce least privilege so low-privilege users cannot reach diagnostic pages.
• Monitor the filesystem for unexpected new or modified files, especially in web-accessible directories, and remove any uploaded shells.
• Review firewall and web logs for unusual requests to diag_routes.php from authenticated sessions.

Detection

• Hunt web server logs for requests to diag_routes.php with unusual or sed-like parameters.
• Monitor for new files appearing in web-accessible or system directories on pfSense hosts.
• Alert on unexpected child processes spawned by the web GUI, particularly sed or netstat invocations with unusual arguments.
• Use file integrity monitoring on pfSense configuration and web directories to catch unauthorized writes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.