CVE-2025-69690 describes a potential code execution issue in Netgate pfSense CE 2.7.2. The vulnerability arises when the module installer processes a backup file containing a serialized PHP object with a specific property (post_reboot_commands), which could lead to code execution. However, the vendor disputes this as a vulnerability because the installer functionality is restricted to administrative users who inherently have permission to execute PHP code, implying this behavior is by design rather than a security flaw.

If exploited, this could allow an administrator with access to the module installer to execute arbitrary PHP code via crafted backup files. Since the installer is restricted to admins, the impact is limited to authorized users and does not represent an escalation of privileges or remote code execution by unauthorized actors. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Given the vendor's position that this behavior is intentional and limited to admin users, no immediate action may be required beyond ensuring that administrative access is tightly controlled and monitored.