CVE-2025-69691
Code Execution in Netgate pfSense CE via XMLRPC API
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| netgate | pfsense_ce | 2.8.0 |
| netgate | pfsense_ce | 2.7.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-915 | The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69691 is a critical vulnerability in Netgate pfSense Community Edition version 2.8.0 that allows authenticated administrators to execute arbitrary PHP code as the root user via the XMLRPC API method called pfsense.exec_php.
This API endpoint is enabled by default and accessible over HTTPS using Basic Authentication. Many deployments use default credentials (admin:pfsense), making it easier for attackers with admin access to exploit this.
Because the API does not validate or sandbox the PHP code executed, an attacker can send a crafted XMLRPC request to run system commands immediately with root privileges.
The vendor acknowledges this behavior as expected for authenticated users and has not issued a patch.
How can this vulnerability impact me? :
This vulnerability can lead to full system compromise because attackers with administrative access can execute arbitrary commands as root.
- Immediate execution of system commands with root privileges.
- Potential persistent compromise of the firewall system.
- Credential theft and unauthorized access.
- Complete takeover of the firewall device, potentially disrupting network security.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying if the pfSense CE 2.8.0 system is running and if the XMLRPC API method pfsense.exec_php is accessible. Since the endpoint is enabled by default and accessible via HTTPS with Basic Authentication, scanning for this API endpoint and checking for default or weak admin credentials can help detect potential exploitation.
Commands to detect this might include using tools like curl or wget to send crafted XMLRPC requests to the pfSense device to verify if the pfsense.exec_php method is accessible and executable. For example, a curl command to test the API endpoint with admin credentials could be used.
- curl -u admin:pfsense -X POST -H "Content-Type: text/xml" --data '<methodCall><methodName>pfsense.exec_php</methodName><params><param><value><string>whoami</string></value></param></params></methodCall>' https://[pfsense-ip]/xmlrpc.php
Monitoring logs for unusual XMLRPC API calls or unexpected PHP code execution can also help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the XMLRPC API endpoint to trusted administrators only and changing default credentials to strong, unique passwords to prevent unauthorized access.
Since the vendor has not issued a patch and considers this behavior expected for authenticated users, it is critical to limit administrative access strictly and monitor for suspicious activity.
- Disable or restrict the XMLRPC API endpoint if it is not needed.
- Enforce strong authentication policies and rotate admin passwords.
- Implement network-level controls such as firewall rules to limit access to the pfSense management interface.
- Monitor system and API logs for unusual or unauthorized commands.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated administrative users to execute arbitrary code as root on pfSense CE 2.8.0, potentially leading to full system compromise, credential theft, and firewall takeover.
Such a compromise could result in unauthorized access to sensitive data or disruption of security controls, which may impact compliance with standards and regulations like GDPR and HIPAA that require protection of personal and health information.
However, since the vulnerability requires administrative authentication and is considered by the vendor as expected behavior for admins, the direct compliance impact depends on the organization's access controls and monitoring practices.