The vulnerability is an OS command injection in the Traffic Shaper Limiters of Netgate pfSense Community Edition versions 2.7.0 through 2.9.0. Authenticated users with Traffic Shaper privileges can alter the hidden ‘number’ field when editing a limiter, causing delete_queue() to pass an unquoted value to dnctl via /bin/sh as root. This allows arbitrary root command execution, jeopardizing confidentiality, integrity, and availability of the device.

Netgate’s pfSense Community Edition releases 2.7.0, 2.8.0, 2.9.0 are affected. Any installation of these versions that uses Traffic Shaper Limiters and contains users with the required permissions is vulnerable.

The CVSS score of 8.6 indicates high severity, while the EPSS score of 8% suggests a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying that large‑scale exploitation has not yet been observed. If an attacker can authenticate as a user with Traffic Shaper privileges, they can submit a malicious hidden ‘number’ value, trigger delete_queue(), and execute arbitrary commands as root with minimal complexity, potentially leading to full device compromise.