Netgate pfSense Community Edition versions 2.7.0 through 2.9.0 contains an operating system command injection flaw in interfaces_qinq_edit.php. An authenticated user with QinQ edit privileges can save an unvalidated parent interface name, which later is injected directly into shell commands executed by ifconfig, allowing the attacker to run arbitrary commands as root. The weakness is rooted in improper input validation leading to a CWE‑78 condition.

The vulnerability applies to all Netgate pfSense CE installations in the 2.7.0 to 2.9.0 release range. Users who possess QinQ edit rights are the susceptible group; earlier or later builds are not affected.

The CVSS base score of 8.6 signals high severity, driven largely by the low vulnerability complexity and high privileges required. Because the exploit requires authenticated access and the ability to edit QinQ settings, it is a local privilege escalation scenario. The EPSS score of 10% indicates a moderate likelihood of exploitation, but the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation.