Executive brief
Netgate pfSense Community Edition is a widely used open-source firewall and routing software. A vulnerability in its management interface allows an authenticated user to execute arbitrary commands with the highest level of system privileges (root). This could lead to a complete takeover of the firewall, allowing an attacker to intercept network traffic, disable security rules, or access sensitive configuration data.
Technical details
The pfSense CE 2.8.0 XMLRPC API exposes a method named 'pfsense.exec_php' that executes arbitrary PHP code without validation or sandboxing. An attacker with valid credentials (even low-privileged ones, according to the CVSS vector provided by CISA-ADP) can send a crafted XMLRPC request to the /xmlrpc.php endpoint to execute system commands as the root user. While the vendor disputes the severity by stating this is intended functionality for administrators, the lack of restrictions on the method allows for trivial remote code execution. No patch is currently available as the vendor considers this expected behavior.
Affected products
- Netgate pfSense Community Edition (CE) 2.8.0
Timeline
- 2025-11: other: Vulnerability discovered
- 2025-12-02: disclosed: Initial report to Netgate
- 2026-01-28: other: CVE assigned by MITRE
- 2026-02-16: advisory: Public disclosure by researcher
- 2026-05-08: other: NVD publication date