Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 4
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-19 20:42
- StatusAwaiting Analysis → AnalyzedNVD modified 2026-10-19 20:42
- StatusReceived → Awaiting AnalysisNVD modified 2026-10-15 21:05
- First seenCVSS 8.6NVD modified 2026-10-15 19:17
Affected (CPE criteria) 1
cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*
References 5
- https://abraxaslabs.tech/research/pfsense-ce-leftovers Issue Tracking
- https://github.com/abraxas/pfsense-config-readonly-restore Third Party Advisory
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L588-L597 Product
- https://github.com/pfsense/pfsense/blob/9363ac5b8651a1c7a333180425ce7719070f95f9/src/etc/inc/config.lib.inc#L743-L798 Product
- https://www.vulncheck.com/advisories/netgate-pfsense-ce-through-2.9.0-authorization-bypass-via-config-restore-and-config-install Third Party Advisory