What is the CVSS score of CVE-2025-69691?

CVE-2025-69691 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of pfSense CE are affected by CVE-2025-69691?

Netgate pfSense CE 2.8.0 contains a disputed XMLRPC authentication vulnerability that permits PHP code execution upon successful administrative compromise.

How to fix or mitigate CVE-2025-69691?

Within 24 hours: audit all administrative accounts and authentication logs for unauthorized XMLRPC API access; restrict XMLRPC endpoint access to trusted administrative workstations via network firewall rules. Within 7 days: enforce multi-factor authentication on all administrative accounts, isolate administrative access to dedicated management VLANs, and review firewall configuration change logs for unauthorized modifications. Within 30 days: evaluate migration to pfSense Plus (commercial version) or alternative firewalls with stronger privilege separation; conduct a comprehensive administrative account hygiene audit and implement hardware security keys for all administrative access.

pfSense CE CVE-2025-69691

EUVD-2025-209739 CRITICAL

Improper Access Control (CWE-284)

2026-05-08 mitre

GHSA-7ww6-9q8h-2g49

PHP Authentication Bypass RCE N A

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Vendor confirms pfsense.exec_php is admin-only intended functionality, so PR:H and S:U (no privilege boundary crossed); an authenticated admin gains full C/I/A over the firewall.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:58 vuln.today

CVSS changed

May 08, 2026 - 22:22 NVD

9.9 (CRITICAL)

CVE Published

May 08, 2026 - 00:00 nvd

CRITICAL 9.9

CVE Published

May 08, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

AnalysisAI

Authenticated code execution in Netgate pfSense CE 2.8.0 is claimed via the XMLRPC API method pfsense.exec_php, which runs attacker-supplied PHP on the firewall. Netgate publicly disputes this as a vulnerability because pfsense.exec_php is restricted to administrators, who are by design permitted to execute PHP, meaning the CVSS 9.9 rating reflects an intended admin capability rather than a privilege boundary being crossed. Publicly available exploit code exists (SSVC PoC), but EPSS is 0.01% and it is not in CISA KEV, indicating no observed active exploitation.

Technical ContextAI

pfSense CE is a FreeBSD-based open-source firewall/router platform whose web GUI and inter-node synchronization use an XMLRPC API. The API exposes pfsense.exec_php, an interface intended to let the administrative config-sync mechanism and admin tooling run arbitrary PHP within the firewall's privileged context. The reported issue is classified as CWE-284 (Improper Access Control), but the vendor's position is that access control is functioning as designed: only accounts already holding administrative privilege can reach this method, and PHP execution is the method's explicit purpose. Thus the 'root cause class' is contested - there is no crossing of a privilege boundary if admin is a prerequisite.

RemediationAI

No vendor-released patch identified at time of analysis, and Netgate disputes that a fix is warranted, so treat pfsense.exec_php as intended admin functionality rather than a bug awaiting a patch. Focus compensating controls on protecting the administrator boundary itself: restrict access to the pfSense web GUI and XMLRPC endpoint to trusted management networks only (do not expose the WebGUI/XMLRPC interface to WAN - trade-off: remote admins must use VPN), enforce strong unique admin credentials plus two-factor authentication to prevent admin account compromise, disable or firewall the config-sync/XMLRPC (High Availability sync) service on standalone deployments that do not use CARP failover (trade-off: breaks HA state synchronization if later enabled), and monitor XMLRPC calls to pfsense.exec_php for anomalous use. Review the full-disclosure post (https://seclists.org/fulldisclosure/2026/Feb/16) and VulDB (https://vuldb.com/vuln/346270) for exploit specifics before deciding whether any action beyond standard admin hardening is required.