CVE-2022-31814: pfBlockerNG OS command injection via HTTP Host header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote root command execution on a perimeter firewall with public exploit code and near-maximum EPSS probability.

What it is

pfSense pfBlockerNG through 2.1.4_26 passes shell metacharacters from the HTTP Host header into an OS command, allowing remote command execution as root. The flaw is trivially reachable over the network without credentials, and the package runs with high privileges on a perimeter firewall, so a single crafted request can fully compromise the device. Version 3.x is unaffected.

Impact

An unauthenticated attacker gains arbitrary command execution as root on the pfSense host, enabling full control of the firewall, interception or redirection of traffic, and lateral movement into protected networks.

Attack surface

Reachable over the network via HTTP requests to the pfBlockerNG-exposed interface; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the advisory title indicate no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.91881 (99.8th percentile) and multiple references are tagged Exploit with public technical descriptions, indicating mature public exploit code.

What to do

• Update pfBlockerNG to a fixed release (3.x or the patched 2.1.4 line) as the primary action.
• If patching is delayed, restrict access to the pfSense webGUI and any pfBlockerNG-exposed endpoints to trusted management networks only.
• Disable or remove the pfBlockerNG package on internet-facing pfSense instances that do not require it.
• Review firewall rules for any exposure of the webGUI or package endpoints to untrusted networks and close them.
• Monitor Netgate advisories and the FreeBSD-ports pull request for the exact fixed revision before deploying.

Detection

• Inspect HTTP request logs and packet captures for Host headers containing shell metacharacters such as ;, |, $(), backticks, or newlines.
• Alert on unexpected child processes spawned by the web server or pfBlockerNG components on the pfSense host.
• Monitor for outbound connections or new files/scripts appearing on the firewall that are not part of normal package updates.
• Correlate pfSense system logs for command execution errors or unusual root-level activity around web requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.