This vulnerability is a configuration injection flaw identified as CWE-93. An authenticated WebGUI user who can edit L2TP or PPPoE Server settings can submit a RADIUS shared secret that contains an unescaped quote and newline. The injected text is incorporated into the mpd5 configuration file, allowing an attacker to append an up-script that runs arbitrary mpd5 commands as the root user when a VPN session starts. The result is full root command execution that compromises confidentiality, integrity, and availability of the pfSense appliance.

The flaw exists in Netgate’s pfSense Community Edition up to and including version 2.9.0. Users running any of those releases on pfSense can be affected if they permit L2TP or PPPoE Server edit privileges to an authenticated account.

The CVSS score is 7.5, indicating a high level of severity. While an EPSS score is not available, the lack of a readily available exploit in public feeds suggests exploitation requires an authentic WebGUI session with sufficient privileges rather than a public remote attack. The vulnerability is not listed in the CISA KEV catalog, but its impact is significant for any attacker who can attain the required privileges. An attacker can force the system to execute arbitrary code under the root user whenever a VPN session is initiated, giving them complete control over the host.