What is the CVSS score of CVE-2025-69690?

CVE-2025-69690 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of pfSense CE are affected by CVE-2025-69690?

Netgate pfSense Community Edition 2.7.2 contains a critical authenticated code execution vulnerability (CVE-2025-69690, CVSS 9.1) in its backup restoration module that could allow compromised or…

How to fix or mitigate CVE-2025-69690?

Within 24 hours: Audit all administrator accounts and access logs for suspicious backup restoration activities across pfSense CE 2.7.2 instances. Within 7 days: Enforce multi-factor authentication for all administrative accounts and restrict management interface access to hardened, trusted networks only; disable remote administrative access if not operationally required. Within 30 days: Monitor Netgate security advisories for patch releases and plan migration to patched versions (pfSense CE 2.7.3 or later) or evaluate alternative firewall appliances if vendor patching timelines are unacceptable.

pfSense CE CVE-2025-69690

EUVD-2025-209738 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-05-08 mitre

GHSA-5vw7-w2ww-jcfq

PHP RCE Deserialization N A

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Reachable over the network web UI (AV:N/AC:L) but only by an existing admin (PR:H); I assess S:U because code runs within the same admin-trust context rather than crossing a security boundary, with full host C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:57 vuln.today

CVSS changed

May 08, 2026 - 22:22 NVD

9.1 (CRITICAL)

CVE Published

May 08, 2026 - 00:00 nvd

CRITICAL 9.1

CVE Published

May 08, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

AnalysisAI

Authenticated PHP code execution in Netgate pfSense CE 2.7.2 arises when the module installer processes a backup file containing a serialized PHP object whose post_reboot_commands property is unserialized (CWE-502), causing attacker-defined commands to run after reboot. Exploitation requires an authenticated administrator (PR:H), and the vendor disputes the report because the installer is an admin-only feature that is intentionally permitted to execute PHP. Publicly available exploit code exists (SSVC exploitation: poc) via a Full Disclosure post, but there is no active-exploitation evidence and EPSS is negligible at 0.01%.

Technical ContextAI

pfSense CE is a FreeBSD-based open-source firewall/router platform whose web administration UI is written in PHP. The reported issue is a PHP Object Injection / insecure deserialization flaw (CWE-502): the module installer accepts a backup file, and when that file embeds a serialized PHP object, unserialize() rehydrates the object graph. A crafted object populated with a post_reboot_commands property leads those commands to be executed on the next reboot, effectively a deferred command-execution primitive on the firewall host. CPE data is unusable here (the feed lists the placeholder cpe:2.3:a:n/a:n/a:*), so exact affected-component identification relies on the description naming pfSense CE 2.7.2.

RemediationAI

No vendor-released patch identified at time of analysis, and Netgate disputes the report as intended behavior, so a fix is unlikely to be issued for this vector. Practical compensating controls focus on the administrator trust boundary rather than the code path: restrict pfSense webConfigurator access to a dedicated management network or VLAN and never expose the admin UI to the internet (side effect: remote admins must use VPN/jump host); enforce strong, unique admin credentials plus MFA where supported and minimize the number of accounts holding admin/System privileges (side effect: operational overhead); and only import backup/module files from trusted, integrity-verified sources, since the exploit primitive is a malicious backup file (side effect: blocks convenience of ad-hoc restores). Review the original disclosure at https://seclists.org/fulldisclosure/2026/Feb/16 and monitor the NVD/EUVD entries for any status change before deprioritizing entirely.