The vulnerability arises from a command injection flaw in services_captiveportal_hasync.php within pfSense CE. Users possessing only the Captive Portal HA privilege can supply a crafted backwardsyncip pointing to a malicious XMLRPC server. When the captive portal module queries this server, the returned user list contains shell metacharacters that are concatenated directly into a pfctl shell command without proper escaping. This enables the attacker to execute arbitrary commands with root privileges on the firewalls running affected pfSense versions.

The flaw affects Netgate's pfSense Community Edition releases 2.7.0 through 2.9.0. The affected products are identified in the CNA list as Netgate:pfSense CE. Only accounts granted Captive Portal HA privileges are required; no additional user privileges are needed beyond the existing feature role.

The CVSS base score of 8.6 indicates high severity, and the EPSS score of about 6% reflects a moderate probability of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, but the required attack vector involves web‑based configuration access and an XMLRPC server under attacker control. Because the flaw allows root‑level command execution, the risk to confidentiality, integrity, and availability is extensive, warranting immediate attention.