CVE-2025-69690

9.1 Critique

Publiée le 08/05/2026 à 09:16 · Modifiée le 15/10/2026 à 21:10 · Analysée par le NVD · Source : cve@mitre.org

Description

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

Traduire en français

Produits concernés

Pfsense pfsense

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-502
CWE-915

Références

https://seclists.org/fulldisclosure/2026/Feb/16 ExploitMailing ListThird Party Advisory
https://www.linkedin.com/in/nelson-adhepeau/ Not Applicable
https://seclists.org/fulldisclosure/2026/Feb/16 ExploitMailing ListThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories