The vulnerability is an OS command injection in the openvpn.connect_async.sh script shipped with pfSense Community Edition up to version 2.9.0. Authenticated VPN users that authenticate through RADIUS or LDAP can supply usernames containing shell metacharacters and single quotes. When the script evaluates the username as part of a pfctl anchor name, the crafted input escapes the intended context and is executed as a command as root. The attacker thus gains full system control, compromising confidentiality, integrity and availability. The weakness is an instance of CWE-78.

Netgate pfSense Community Edition installations that use OpenVPN authentication via RADIUS or LDAP and are running any version up to 2.9.0 are vulnerable.

The CVSS score of 7.7 classifies this as a high severity vulnerability. EPSS score is 5%, and it is not listed in the CISA KEV catalog. Exploitation requires only that an attacker is an authenticated VPN user with the ability to submit credentials containing shell characters. By providing such a username, the attacker can trigger the vulnerable script and execute arbitrary commands as root. The likely attack vector is an authenticated user supplying a crafted username during VPN authentication.