The vulnerability is an OS command injection that allows authenticated users with gateway edit privileges to inject shell metacharacters into an IPv6 link-local zone index. By setting a gateway Monitor IP that carries a payload, an attacker can cause the start_dpinger() function to pass the unescaped value to the dpinger shell command, enabling execution of arbitrary commands as the root user. This flaw could lead to full system compromise, affecting confidentiality, integrity, and availability of the pfSense appliance.

Affected product is Netgate pfSense Community Edition. The issue exists in the code that constructs the dpinger command from the gateway Monitor IP field.

The CVSS base score of 8.6 indicates a high severity vulnerability, and the EPSS score of 5% indicates a realistic chance of exploitation, especially because privileged users can exploit it. Since only authenticated users with gateway edit rights can exploit this flaw, the likely attack vector is local, based on the description. The vulnerability is not listed in CISA KEV, but the potential impact warrants immediate attention. Exploitation is straightforward once the authenticated session is obtained, with no additional prerequisites beyond the ability to edit gateway settings.