A flaw in Netgate pfSense CE versions 2.7.0 through 2.9.0 allows authenticated users with IPsec Mobile privileges to embed a single‑character banner that injects shell commands into the strongswan.conf attribute. The injected commands are executed with root privileges when the IPsec daemon restarts, enabling an attacker to run arbitrary code, alter system configuration, or compromise confidentiality, integrity, and availability of the device.

Netgate's pfSense Community Edition, specifically versions 2.7.0 to 2.9.0 which expose the vulnerable login_banner field in the IPsec configuration interface.

The CVSS score of 8.6 indicates a high severity. The EPSS score is less than 1%, implying a low probability of exploitation. It is not listed in CISA KEV. The vulnerability requires authenticated users with IPsec Mobile privileges; after setting a single‑character banner that contains '}', the attacker must trigger a restart of the IPsec service to have the malicious scripts executed as root. The combination of privileged access and full system compromise presents a significant risk for any environment where such user accounts are present.