The vulnerability exists in the services_unbound_acls.php script of Netgate pfSense CE, allowing an authenticated user with DNS Resolver: Access Lists rights to inject CR and LF characters into the aclname or aclaction fields. Those characters are written to the access_lists.conf file, where they can create new Unbound directives such as local-data, local-zone, or forward-zone. By manipulating these entries an attacker can alter the DNS answers served to clients on the local network, enabling spoofing or traffic diversion.

Netgate pfSense Community Edition, versions up to and including 2.9.0, is susceptible to this.

The flaw carries a CVSS score of 5.1, indicating moderate severity, and an EPSS score of 2 %, suggesting a low likelihood of exploitation at this time. It is not listed in the CISA KEV catalog. The attack requires authenticated access, specifically the privilege to edit DNS Resolver access lists, so the vector is internal or requires user credential compromise. Once exploited, the attacker can modify DNS responses for LAN clients, potentially enabling phishing or other downstream attacks. While the exposure is not high‑risk externally, the ability to tamper with DNS can have considerable operational impact if the vulnerability is leveraged strategically.