Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 8, 2026 · NIST NVD

   Detected

   Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

2. Oct 15, 2026 · NIST NVD

   Updated

   Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

Affected

• cpe pfsense/pfsense2.7.2

Sources

• CVE.orgVulnerability recordCVE-2025-69690

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2025-69690

  Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionall

  nvd.nist.gov

References

• Exploit · seclists.org
• Not Applicable · linkedin.com