The vulnerability is an OS command injection flaw in the openvpn.learn-address.sh script used by pfSense CE 2.5.0 through 2.9.0. It permits authenticated VPN clients to embed shell metacharacters in the certificate common name or username. Those credentials are interpolated unquoted into su -c command strings when DNS Resolver client registration is enabled, giving the attacker the ability to execute arbitrary commands as the unbound user. This results in a local integrity compromise for the affected system.

Netgate pfSense CE products with firmware versions 2.5.0 through 2.9.0 are impacted. No additional version ranges are known.

The CVSS score is 2.3, indicating a low severity. EPSS of 3% suggests a modest likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated VPN client, DNS Resolver client registration enabled, and a shell metacharacter in the client’s certificate or username. Successful exploitation would allow execution of commands under the unbound user, potentially providing a foothold for further compromise depending on the privileges granted to that user.