CVE-2025-69691

The XMLRPC API interface in pfSense CE 2.8.0 exposes the pfsense.exec_php method, which allows arbitrary PHP code execution on the server. An attacker authenticated as an administrator can pass a PHP payload through this API call and achieve code execution in the system context. The vendor argues this is intentional behavior — administrators are deliberately granted the ability to execute PHP code.

An authenticated administrator can obtain full code execution on the server (RCE) with potential takeover of system control, its configuration and network data. Due to the scope (C:H/I:H/A:H, S:C), the impact may extend beyond the pfSense system itself.

Patches available from the vendor should be applied according to the references. Due to the vendor's dispute regarding the nature of the vulnerability, it is recommended to restrict access to the XMLRPC interface exclusively to trusted IP addresses, use strong and unique passwords for administrative accounts, and minimize the number of accounts with administrator privileges.

Netgate pfSense CE 2.8.0