CVE-2025-69691

EUVD-2025-209739
Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 40%
Affected Products (NVD)
VendorProductVersion
pfsensepfsense
2.8.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://seclists.org/fulldisclosure/2026/Feb/16
https://www.linkedin.com/in/nelson-adhepeau/
https://seclists.org/fulldisclosure/2026/Feb/16