pfSense CE EUVD-2026-102333

Exploitation requires an authenticated pfSense CE WebGUI account that holds the L2TP Server or PPPoE Server edit privilege (PR:H) - it is not available to anonymous or read-only users. The concrete trigger is submitting a RADIUS shared secret value containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, which must reference a RADIUS-backed configuration so the secret is written into the mpd5 configuration. Execution is deferred and conditional: the injected up-script runs as root only when an L2TP or PPPoE session actually starts (AC:H/AT:P), so a configured and in-use VPN server is a practical prerequisite. The main limiting factors are the required privileged WebGUI role and the dependency on a session-start event rather than immediate execution.

This is a genuine but access-gated code execution flaw, not a mass-exploitation threat. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N, VC:H/VI:H/VA:H) resolves to 7.5 (High) and is internally consistent with the description: PR:H correctly reflects that the attacker must already hold L2TP or PPPoE Server edit privileges in the pfSense WebGUI, AC:H/AT:P reflect that payload execution is not immediate but is deferred until a VPN session actually starts and runs the injected up-script as root. The full-triad high impact (root command execution) is credible given CWE-93 argument/newline injection into the mpd5 configuration. Publicly available exploit code exists (abraxas/pfsense-l2tp-radius-mpd, corroborated by a VulnCheck advisory), which raises practical risk, but this must NOT be conflated with active exploitation: there is no CISA KEV listing and no EPSS score in the input, so widespread opportunistic exploitation is unconfirmed. The dominant mitigating signal is PR:H - an attacker who can edit VPN server secrets is already a highly privileged operator, so the real-world value is primarily privilege escalation from a constrained WebGUI role to root, or post-authentication persistence, rather than initial access. Net: a real priority for environments that delegate VPN-server administration to non-root operators, but lower urgency where only full administrators have WebGUI access.

An attacker holding a delegated pfSense WebGUI account with L2TP or PPPoE Server edit rights submits a RADIUS shared secret containing a quote and newline via vpn_l2tp.php or services_pppoe_edit.php, smuggling an extra mpd5 directive that appends an up-script. When the next L2TP/PPPoE session starts, mpd5 executes the injected script as root, yielding full command execution on the firewall. Working exploit code is publicly available, lowering the skill required, though the attacker must already be authenticated with the relevant edit privilege and wait for a session to trigger.