A flaw in the XMLRPC API enables execution of arbitrary PHP code through the pfsense.exec_php method. The function does not perform proper sanitization or restriction of the code that can be supplied, allowing an attacker with the ability to invoke the API to run any PHP script. This can lead to full compromise of the affected system, including disclosure of sensitive configuration data, modification of network rules, and availability disruption by terminating services.

The vulnerability is reported against Netgate pfSense CE 2.8.0. Only administrative users are allowed to call the vulnerable method, so the attack surface is limited to accounts with admin privileges or to users who can obtain such credentials.

Because the flaw permits code execution, the risk is high, with a CVSS score of 9.9. The EPSS score of < 1% and absence from the KEV catalog suggest that it has not been widely exploited yet, but a single successful exploit can lead to a full compromise. No public remediation is yet available; the supplier disputes the severity by noting the API is intentionally for administrators. Nonetheless, the inherent nature of code execution remains a critical threat.