Netgate pfSense Community Edition versions 2.7.1 through 2.9.0 contain a CRLF injection flaw in services_unbound_advanced.php. The sock_queue_timeout parameter can be written with carriage‑return and line‑feed characters that are not validated before being inserted directly into Unbound’s configuration file. An authenticated user who holds the DNS Resolver: Advanced privilege can thus inject arbitrary Unbound directives, effectively overriding local DNS records and forwarding rules for every client that relies on the resolver. The weakness is classified as CWE‑93 and can lead to DNS spoofing or the redirection of traffic away from legitimate destinations. Confidentiality may be compromised if spoofed responses return sensitive data, integrity is broken by erroneous DNS resolutions, and availability can be disrupted if legitimate DNS queries are blocked or misdirected.

The vulnerability affects installations of Netgate pfSense Community Edition between versions 2.7.1 and 2.9.0, inclusive. Any deployment of these releases that uses the web interface to configure Unbound’s advanced settings is susceptible to exploitation if the user has DNS Resolver: Advanced permissions.

The CVSS score of 5.1 indicates a medium severity assessment. The EPSS score is listed as < 1%, which implies a very low probability of active exploitation at present. The vulnerability is not featured in the CISA KEV catalog, so no widespread public exploits are documented. Attackers must first authenticate to the web interface and possess the DNS Resolver: Advanced privilege, after which they can modify unbound.conf and affect the entire client network.