Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-02-17 | 1 | Disclosure1 |
| 2026-05-10 | 1 | False Positive1 |
CVE-2025-69691 Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admi… https://www.cve.org/CVERecord?id=CVE-2025-69691
Post summary
The text references a claimed code‑execution vulnerability in pfSense CE but notes the supplier disputes its validity, with no PoC, exploit, or patch details provided.
We have just added an important vulnerability affecting Netgate pfSense CE (CVE-2025-69691) https://vuldb.com/?id.346270
Post summary
An important vulnerability (CVE‑2025‑69691) has been identified in Netgate pfSense CE, with details posted on VulDB.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pfsense | pfsense | 2.8.0 | - | - |