A critical vulnerability in Netgate pfSense CE 2.7.2 allows authenticated administrators to achieve remote code execution through the module installer interface.

This vulnerability involves insecure deserialization within the module installer, permitting arbitrary PHP code execution. The attacker must possess administrative privileges to interact with the module installer functionality.

Successful exploitation allows an attacker with administrative access to execute arbitrary code on the underlying operating system. Given the CVSS score of 9.1, this represents a critical risk to network integrity, potentially allowing an attacker to bypass security controls, exfiltrate sensitive configuration data, or pivot into the internal network.

Immediate Action: Restrict administrative access to the pfSense web interface to trusted management IP addresses only and monitor for unauthorized changes to system modules.

Proactive Monitoring: Review system logs for unusual activity associated with the module installer and audit any newly installed or modified packages.

Compensating Controls: Ensure the web management interface is not exposed to the public internet and utilize a VPN or jump host to manage the device.

Public Exploit Available: Unknown (no weaponized exploit confirmed).

While the vendor maintains that this functionality is intended for administrative use, the potential for unauthorized code execution remains a high-severity concern. Administrators should strictly limit access to the management interface and monitor for any anomalous administrative activity to mitigate the risk of compromise.