CVE-2025-69690CWE-502CWE-915insecure-deserialization

CVE-2025-69690

Critical · published May 8, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00810 · 56.5th percentile
Weaknesses
CWE-502 · Deserialization of Untrusted Data; CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes
Published
2026-05-08T11:16Z
Affected products (1)
ProductVersionsFixed in
pfsense/pfsenseall versions—
References (3)
https://seclists.org/fulldisclosure/2026/Feb/16 · [email protected]https://www.linkedin.com/in/nelson-adhepeau/ · [email protected]https://seclists.org/fulldisclosure/2026/Feb/16 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 MAY 00:00Z
    Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the…
    cvelistv5