pfSense CE EUVD-2026-102331

Requires an authenticated user holding the specific pfSense PPPoE Server Edit privilege (PR:H) and a configured/enabled PPPoE server; the injected payload only executes when a PPPoE client actually authenticates (AT:P), meaning exploitation is not self-contained and depends on a client authentication event. The attack works against the standard PPPoE server configuration path (services_pppoe_edit.php) because the username POST field is not validated for newline characters. Limiting factors: high administrative privilege needed, PPPoE server feature must be in use, and a successful client authentication must occur to trigger root command execution - so this cannot be exploited by an unauthenticated or low-privilege remote attacker.

This is a post-authentication privilege-escalation / command-injection flaw, not a remotely-exploitable unauthenticated breach. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N, score 7.5) is internally consistent with the description: it requires PR:H (the attacker must already hold the PPPoE Server Edit privilege), AC:H and AT:P (a PPPoE client must subsequently authenticate to trigger execution), yielding full VC:H/VI:H/VA:H because mpd5 runs the injected command as root. A public POC exists (abraxas/pfsense-pppoe-secret-bang, reported by VulnCheck), so exploit code is available, but there is NO CISA KEV entry and no EPSS score was provided - so there is no evidence of active, widespread exploitation. The real-world risk is therefore moderate and conditional: the high privilege requirement and the dependency on a PPPoE client authentication event sharply limit mass exploitation, but the impact (root on a perimeter firewall) is severe. Treat this as a trust-boundary / privilege-escalation hardening issue rather than an emergency internet-facing RCE. Note: no KEV/EPSS data was supplied, so exploitation-probability signals could not be cross-referenced.

An operator or compromised account holding the pfSense PPPoE Server Edit privilege submits a username field containing an embedded newline followed by a secret beginning with '!', injecting a crafted entry into mpd.secret. When any PPPoE client subsequently authenticates against the server, mpd5 interprets the '!'-prefixed secret as a command and executes it as root. A public POC (abraxas/pfsense-pppoe-secret-bang) demonstrates the newline injection.