CVE-2025-69691

9.9 Critique

Publiée le 08/05/2026 à 09:16 · Modifiée le 15/10/2026 à 21:10 · Analysée par le NVD · Source : cve@mitre.org

Description

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

Traduire en français

Produits concernés

Pfsense pfsense

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.9 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-284
CWE-915

Références

https://seclists.org/fulldisclosure/2026/Feb/16 ExploitMailing ListThird Party Advisory
https://www.linkedin.com/in/nelson-adhepeau/ Not Applicable
https://seclists.org/fulldisclosure/2026/Feb/16 ExploitMailing ListThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories