The flaw resides in the configuration restore mechanisms, specifically config_restore() and config_install(), which ignore the 'User - Config: Deny Config Write' permission. As a result, read‑only WebGUI users can upload a malicious config.xml through pages such as services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php. Once the altered configuration is processed and the system reloads or reboots, the attacker gains full root privileges, enabling arbitrary code execution.

All Netgate pfSense Community Edition builds up to and including version 2.9.0 are impacted. The vulnerability is tied to the config_lib.inc implementation shared across these releases.

The CVSS score of 8.6 reflects a high severity condition, while the EPSS of less than 1% indicates a low current exploitation probability. The weakness is not yet listed in CISA's KEV catalog. The attack vector is inferred to be via the web interface; an attacker must have page privileges for the affected PHP pages, which is more likely for users with limited GUI permissions but sufficient service rights. Once the malicious configuration is loaded, the attacker can execute code as root.