This vulnerability is an operating‑system command injection in pfSense CE 2.4.5 through 2.9.0. An authenticated user with Advanced Admin access can submit arbitrary content in sshguard threshold, block time or detection time fields through the WebGUI, which is written directly into sshguard.conf without proper validation. On a firewall restart the file is sourced with root privileges, allowing the attacker to inject commands such as $(…) or newline characters that are executed as root. This flaw permits the attacker to run arbitrary system commands, compromising confidentiality, integrity and availability of the device.

Netgate pfSense Community Edition versions 2.4.5 up to and including 2.9.0. The affected component is the WebGUI page system_advanced_admin.php, specifically the handling of Login Protection settings that are persisted to sshguard.conf. Any deployment of these pfSense releases that grants Advanced Admin rights to a WebGUI user is vulnerable.

The CVSS score of 8.6 indicates a high severity, and the EPSS 7% demonstrates a moderate likelihood that the vulnerability will be exploited in the near term. The flaw is not listed in CISA's KEV catalog, but the combination of authenticated access, root execution and a trivial input sanitization failure creates a clear attack path. An attacker who has obtained Advanced Admin credentials can trigger the injection with a single form submission, meaning that breach of user credential compromise directly translates into root privileges on the firewall.