pfSense Community Edition versions up to 2.9.0 contain a crontab injection vulnerability in the interfaces_ppps_edit.php script. The flaw allows authenticated users who possess the ‘WebCfg – Interfaces: PPPs: Edit’ privilege to submit crafted POST values that include newlines in the ptpid or reset hour/minute fields. These values are then written directly, without escaping, to /etc/crontab by the configure_cron() function, enabling an attacker to schedule arbitrary commands that run as the root user. The weakness is an instance of CWE‑93, improper neutralization of CRLF characters in web input, and results in full system compromise should it be exploited.

All Netgate pfSense Community Edition deployments with a version of 2.9.0 or earlier are impacted. The vulnerability is tied to the web interface component that handles PPP configuration, and requires an authenticated session with the right page access. No other product or version is presently affected.

The CVSS score of 8.6 indicates a high severity and potential for remote code execution with root privileges. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the exploit requires only a privileged web‑interface account, which many installations have for system management. Attackers with such access can create malicious cron entries that execute when the system reloads the crontab, leading to persistent compromise and the ability to run arbitrary commands or install back‑doors. The lack of a public exploit does not diminish the need for prompt remediation, as the fault is straightforward to leverage once the conditions exist.