CVE-2025-69691

Published: May 8, 2026Modified: Jun 17, 2026

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

Affected (1)

Products: Pfsense: Pfsense

Pfsense

1 product

Pfsense

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pfsense Pfsense	Version 2.8.0

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

References (3)

https://seclists.org/fulldisclosure/2026/Feb/16

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://www.linkedin.com/in/nelson-adhepeau/

Source: cve@mitre.org

Not Applicable

https://seclists.org/fulldisclosure/2026/Feb/16

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMailing ListThird Party Advisory

Timeline

No history available yet.