Executive brief
Netgate pfSense CE is a popular open-source firewall and routing software used to secure corporate and home networks. A vulnerability in the configuration restore process allows an administrator to execute arbitrary commands with full system privileges by uploading a specially crafted backup file. While this requires administrative access, it could be used by a malicious insider or an attacker who has already compromised an admin account to gain permanent, deep-level control over the firewall hardware.
Technical details
An authenticated remote code execution vulnerability exists in pfSense CE 2.7.2 due to the unsafe use of the PHP unserialize() function within the configuration restore mechanism. The 'pfsense_module_installer' class handles user-controlled data from backup files without proper class whitelisting or input validation. An attacker with administrative privileges can craft a backup file containing a serialized PHP object with a malicious 'post_reboot_commands' property. When the restore operation is triggered, the system unserializes the object and executes the embedded commands via mwexec() with root privileges. The vendor has disputed the vulnerability, stating that administrators are intentionally permitted to execute PHP code, and no patch is currently planned.
Affected products
- Netgate pfSense CE 2.7.2
Timeline
- 2025-11: other: Vulnerability discovered
- 2025-12-02: disclosed: Initial report to Netgate
- 2026-01-28: other: CVE assigned by MITRE
- 2026-02-16: advisory: Public disclosure via Full Disclosure mailing list
- 2026-05-08: other: NVD publication