{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2025-69690","sourceIdentifier":"cve@mitre.org","published":"2026-05-08T07:16:28.750","lastModified":"2026-10-15T19:10:00.173","vulnStatus":"Analyzed","cveTags":[{"sourceIdentifier":"cve@mitre.org","tags":["disputed"]}],"descriptions":[{"lang":"en","value":"Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code."},{"lang":"es","value":"Netgate pfSense CE 2.7.2 permite la ejecución de código mediante el uso del instalador de módulos con un archivo de copia de seguridad con un objeto PHP serializado que contiene la propiedad post_reboot_commands. NOTA: el Proveedor refuta esto porque este instalador solo está disponible para administradores y se les permite intencionalmente ejecutar código PHP."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-08T19:24:45.021895Z","id":"CVE-2025-69690","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"},{"lang":"en","value":"CWE-915"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pfsense:pfsense:2.7.2:*:*:*:community:*:*:*","matchCriteriaId":"CFDCFA7A-4A54-4FB8-8548-008179AD8BD5"}]}]}],"references":[{"url":"https://seclists.org/fulldisclosure/2026/Feb/16","source":"cve@mitre.org","tags":["Exploit","Mailing List","Third Party Advisory"]},{"url":"https://www.linkedin.com/in/nelson-adhepeau/","source":"cve@mitre.org","tags":["Not Applicable"]},{"url":"https://seclists.org/fulldisclosure/2026/Feb/16","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mailing List","Third Party Advisory"]}]}}