1. Home
  2. CVE Database
  3. CVE-2025-69691
CRITICAL · 9.9

CVE-2025-69691

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allo...

Vulnerability Description

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.

CVSS Score

9.9

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
PfsensePfsense2.8.0

Related Weaknesses (CWE)

CWE-915CWE-284

References

FAQ

What is CVE-2025-69691?

CVE-2025-69691 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allo...

How severe is CVE-2025-69691?

CVE-2025-69691 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-69691?

Check the references section above for vendor advisories and patch information. Affected products include: Pfsense Pfsense.