{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "CVE-2025-69690 \u0026 CVE-2025-69691",
          "vendor": "Cve",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "privexploits via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory: Authenticated Remote Code Execution in pfSense CECVEs: CVE-2025-69690, CVE-2025-69691\nResearcher: Nelson Adhepeau (privexploits () protonmail com)\nDate: February 2026\n\n\n== RESPONSIBLE DISCLOSURE NOTICE ==\n\nThis advisory is published in accordance with responsible disclosure practices.\u00a0\n\nThe vendor was notified on December 2, 2025, acknowledged the reports, and indicated no patches would be issued. \nPublication follows standard 90-day disclosure guidelines.\n\n-------------------------------------------------------------\n\n== OVERVIEW ==\n\nTwo independent authenticated Remote Code Execution\nvulnerabilities were discovered in Netgate pfSense Community\nEdition. Both were reproduced on clean installations. Vendor\nwas contacted and acknowledged the reports but classified both\nas expected behavior for authenticated administrators.\n\n-------------------------------------------------------------\n\n== CVE-2025-69690 ==\nAuthenticated RCE via Unsafe Deserialization (pfSense CE 2.7.2)\n\nCVSS v3.1: 8.8 (High)\nVector: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\nCWE-502: Deserialization of Untrusted Data\nCWE-915: Improperly Controlled Dynamic Code Evaluation\n\n-- Description --\n\nThe pfSense configuration restore mechanism invokes\nunserialize() on user-controlled data without class\nwhitelisting, input validation, or sandboxing.\n\nA crafted backup file containing a malicious serialized PHP\nobject can inject arbitrary commands via the\npost_reboot_commands property, executed through mwexec()\nwith full root privileges.\n\n-- Affected Component --\n\nbackup/restore mechanism, config.php,\npfsense_module_installer class, unserialize() handling\n\n-- Attack Vector --\n\n1. Attacker authenticates as administrator\n2. Uploads malicious configuration backup file\n3. Triggers restore operation\n4. pfSense unserializes attacker-controlled data\n5. Commands execute as root via mwexec()\n\n-- PoC Payload --\n\nO:23:\"pfsense_module_installer\":1:{\n\u00a0 s:17:\"*post_reboot_commands\";\n\u00a0 a:1:{i:0;s:40:\"/usr/local/bin/php -r \u0027system(\\\"id\\\");\u0027\";}}\n\n-- Impact --\n\n- Arbitrary command execution as root\n- Persistent compromise\n- Complete firewall takeover\n- Credential and configuration exfiltration\n\n-- Vendor Response --\n\nNetgate acknowledged the report. Classified as\n\"authenticated administrative abuse\". No patch issued.\nVendor does not assign CVEs directly.\n\n-------------------------------------------------------------\n\n== CVE-2025-69691 ==\nAuthenticated RCE via XMLRPC exec_php (pfSense CE 2.8.0)\n\nCVSS v3.1: 9.9 (Critical)\nVector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\nCWE-284: Improper Access Control\nCWE-915: Improperly Controlled Dynamic Code Evaluation\n\n-- Description --\n\npfSense CE 2.8.0 exposes an XMLRPC API method\npfsense.exec_php that executes arbitrary PHP code as root\nwithout validation, sandboxing, or restrictions.\n\nThe endpoint is enabled by default, accessible over HTTPS\nvia Basic Authentication, and executes supplied code\nimmediately with full system privileges. Default credentials\n(admin:pfsense) are widely deployed, significantly lowering\nthe exploitation barrier.\n\n-- Affected Component --\n\nxmlrpc.php, pfsense.exec_php method, XMLRPC API handler,\nBasicAuth authentication layer\n\n-- Attack Vector --\n\ncurl -k -u admin:pfsense \\\n\u00a0 -d \u0027\u003cmethodCall\u003e\n\u00a0 \u00a0 \u003cmethodName\u003epfsense.exec_php\u003c/methodName\u003e\n\u00a0 \u00a0 \u003cparams\u003e\u003cparam\u003e\u003cvalue\u003e\u003cstring\u003e\n\u00a0 \u00a0 \u00a0 system(\"id\");\n\u00a0 \u00a0 \u003c/string\u003e\u003c/value\u003e\u003c/param\u003e\u003c/params\u003e\n\u00a0 \u003c/methodCall\u003e\u0027 \\\n\u00a0 https://\u003ctarget\u003e/xmlrpc.php\n\n-- Impact --\n\n- Full remote root compromise\n- Arbitrary file read/write\n- Backdoor deployment\n- Firewall rule manipulation\n- Extraction of secrets and configurations\n\n-- Vendor Response --\n\nNetgate acknowledged the report. Classified as expected\nbehavior for authenticated users. No patch in pfSense CE\n2.8.0. Still exploitable as of latest version at time\nof disclosure.\n\n-------------------------------------------------------------\n\n== TIMELINE ==\n\n- November 2025: Vulnerabilities discovered\n- December 2, 2025: Initial report sent to Netgate\n- Netgate acknowledged, no patch planned\n- January 28, 2026: CVEs assigned by MITRE\n- February 2026: Public disclosure\n\n-------------------------------------------------------------\n\n== REFERENCES ==\n\nCVE-2025-69690:\nhttps://cve.org/CVERecord?id=CVE-2025-69690\n\nCVE-2025-69691:\nhttps://cve.org/CVERecord?id=CVE-2025-69691\n\nResearcher:\nhttps://github.com/privlabs\nhttps://linkedin.com/in/nelson-adhepeau\n\n-------------------------------------------------------------\nNelson Adhepeau\nIndependent Security Researcherprivexploits () protonmail com\n\n\nEnvoy\u00e9 avec un e-mail s\u00e9curis\u00e9 Proton Mail._______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-502",
              "description": "CWE-502",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-915",
              "description": "CWE-915",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:47Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/16"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Feb/16"
        },
        {
          "url": "https://cve.org/CVERecord?id=CVE-2025-69690"
        },
        {
          "url": "https://cve.org/CVERecord?id=CVE-2025-69691"
        },
        {
          "url": "https://github.com/privlabs"
        },
        {
          "url": "https://linkedin.com/in/nelson-adhepeau"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Feb/16"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Full Disclosure] CVE-2025-69690 \u0026 CVE-2025-69691 \u2014 Authenticated RCE in Netgate pfSense CE 2.7.2 and 2.8.0",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-69690",
              "type": "related"
            },
            {
              "destId": "CVE-2025-69691",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0187",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/16",
            "automated": true,
            "contentSha256": "a3a7e23d245c41605776753f9e09c79964dff2ba5b758a5485a90b64609442fd",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/16",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-02-16T14:09:25Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0187"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T10:11:47Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0187"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}