A newline injection flaw in the services_pppoe_edit.php file allows users with PPPoE Server Edit privilege to inject entries into mpd.secret by providing a specially crafted username POST field. When the injected secret line begins with the character '!', the mpd5 daemon interprets it as a command and executes it with root privileges during PPPoE client authentication. The vulnerability is a classic CWE-93 command injection that enables privileged command execution.

Netgate pfSense Community Edition versions up to and including 2.9.0 are affected. The flaw resides in the PPPoE server configuration editor and requires the user to possess edit permissions for PPPoE servers.

The CVSS score of 7.5 classifies the issue as high severity. While the EPSS score is not available, the vulnerability is not currently listed in the CISA KEV catalog, indicating no known widespread exploitation yet. However, because the attack requires PPPoE Server Edit rights, it can only be triggered by a privileged local user, but the consequence is full root access to the system when a PPPoE client connects. The risk is significant for any environment where untrusted users could acquire such privileges or where PPPoE services are exposed to untrusted clients.