The vulnerability allows an authenticated user who has Wireless Edit or Interface Assignment rights to supply a crafted wireless parent interface name containing shell syntax. The application then interpolates this value directly into an ifconfig command without any escaping. The result is arbitrary OS command execution as root. Because the attack requires only standard authenticated access to the web interface and does not need elevated privileges beyond the user's role, the confidentiality, integrity, and availability of the firewall system are all compromised. The impact is therefore the ability for an attacker to run any shell command with root privileges, effectively gaining full control over the device.

Netgate’s pfSense Community Edition firmware up to and including version 2.9.0 is affected. The issue resides in the wireless parent interface handling code referenced in interfaces_wireless_edit.php and interfaces_assign.php. Updating to a later pfSense CE release that contains the patch is required to eliminate this weakness.

The CVSS score of 8.6 denotes a high severity vulnerability. EPSS score of 7% indicates a moderate probability of exploitation, but the requirement for only authenticated access to the web interface makes the attack path relatively straightforward. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation involves submitting a payload such as "ath0;<cmd>" via the Wireless Edit or Interface Assign pages, which is then executed in a shell context as root. As a result, the risk remains high for any system that has not applied the fix.