This vulnerability involves code execution in Netgate pfSense CE 2.7.2 through the module installer by leveraging a backup file that includes a serialized PHP object containing the post_reboot_commands property. The issue is related to unsafe deserialization (CWE-502) and improper restriction of dangerous operations (CWE-915). The supplier disputes the vulnerability classification because the module installer is restricted to admin users who are permitted to execute PHP code. The CVSS 3.1 base score is 9.1, reflecting critical severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrative privileges to execute arbitrary PHP code on the system, potentially leading to full system compromise. However, since the module installer is only accessible to authenticated administrators, the risk is limited to scenarios where an attacker has already gained administrative access. There are no known exploits in the wild. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor disputes this as a vulnerability due to the installer’s restricted access to administrators, no official fix or mitigation has been published. Administrators should ensure that access to the module installer is tightly controlled and monitor for any unauthorized administrative access. Follow vendor communications for updates on remediation.