CVE-2025-69690: pfsense Deserialization of Untrusted Data
Vulnerability summary
CVE-2025-69690 is a critical (CVSS 9.1) Deserialization of Untrusted Data vulnerability in pfsense. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 08-05-2026Last modifiedVulnerability information updated.
Description
Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.81%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.81% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Affected systems
Pfsense1 product
- pfsense2.7.2
1 vendor · 1 product
References
2 links- www.linkedin.com/in/nelson-adhepeau/Not Applicable