CVE-2025-69690

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://seclists.org/fulldisclosure/2026/Feb/16	Exploit Mailing List Third Party Advisory
https://www.linkedin.com/in/nelson-adhepeau/	Not Applicable
https://seclists.org/fulldisclosure/2026/Feb/16	Exploit Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pfsense:pfsense:2.7.2:*:*:*:community:*:*:*

History

15 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Netgate pfSense CE 2.7.2 permite la ejecución de código mediante el uso del instalador de módulos con un archivo de copia de seguridad con un objeto PHP serializado que contiene la propiedad post_reboot_commands. NOTA: el Proveedor refuta esto porque este instalador solo está disponible para administradores y se les permite intencionalmente ejecutar código PHP.

Information

Published : 2026-05-08 07:16

Updated : 2026-10-15 19:10

NVD link : CVE-2025-69690

Mitre link : CVE-2025-69690

CVE.ORG link : CVE-2025-69690

JSON object : View

Products Affected

pfsense

pfsense

CWE

CWE-502

Deserialization of Untrusted Data

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2025-69690", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69690", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-08T19:24:45.021895Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-08T07:16:28.750", "references": [{"url": "https://seclists.org/fulldisclosure/2026/Feb/16", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.linkedin.com/in/nelson-adhepeau/", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://seclists.org/fulldisclosure/2026/Feb/16", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-502"}, {"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code."}, {"lang": "es", "value": "Netgate pfSense CE 2.7.2 permite la ejecuci\u00f3n de c\u00f3digo mediante el uso del instalador de m\u00f3dulos con un archivo de copia de seguridad con un objeto PHP serializado que contiene la propiedad post_reboot_commands. NOTA: el Proveedor refuta esto porque este instalador solo est\u00e1 disponible para administradores y se les permite intencionalmente ejecutar c\u00f3digo PHP."}], "lastModified": "2026-10-15T19:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pfsense:pfsense:2.7.2:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "CFDCFA7A-4A54-4FB8-8548-008179AD8BD5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}