Netgate pfSense CE: Authorization bypass via config restore and install

Summary

pfSense CE up to and including 2.9.0 does not enforce the 'User - Config: Deny Config Write' privilege in config_restore() and config_install(). A WebGUI user who holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php or diag_backup.php can replace config.xml with a chosen file. According to the CVE record, this can lead to root-level code execution after a reload or reboot. Exploitation requires an authenticated account with these page privileges; the NVD vector assumes high privileges (PR:H).

Affected

• Netgate pfSense CE through 2.9.0
• Development snapshot 2.9.0-DEVELOPMENT (commit 9363ac5) is named in the research as affected

Fixed in

Unknown.

Workaround

• Do not rely on the Deny Config Write privilege to protect the configuration.
• Remove access to services_acb.php, uploadconfig.php, diag_confbak.php and diag_backup.php from all accounts that do not need them.
• Restrict WebGUI access to a management VLAN or VPN; never expose it directly to the internet.
• Remove shared administrator accounts and audit user privileges.
• Keep offline configuration backups and compare config.xml against a known-good copy.

Netgate has not published mitigations; these are not verified vendor guidance.

Exploitation

• Known exploitation: no evidence found.
• A public proof-of-concept repository is referenced in the CVE references and tagged as an exploit; its contents were not assessed.
• CISA SSVC: Exploitation poc, Automatable no, Technical Impact total.
• EPSS is low (about 1%).

Our recommendation

• Check all pfSense CE systems up to 2.9.0 for WebGUI exposure.
• Review non-admin accounts and remove the four listed page privileges where not needed.
• Restrict WebGUI access to trusted networks and back up the configuration offline.
• Monitor Netgate release notes and apply the fix as soon as it is published, since no fixed version is known yet.
• Check config.xml for unexpected changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Abraxas Labs research abraxaslabs.tech
• Abraxas Labs GitHub repository github.com
• pfSense source config.lib.inc (lines 588-597) github.com
• pfSense source config.lib.inc (lines 743-798) github.com
• Netgate pfSense privileges documentation docs.netgate.com
• Netgate tracker issue 15908 redmine.pfsense.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:57.