Netgate pfSense CE 2.8.0 contains a highly permissive XMLRPC API that allows administrative users to execute arbitrary PHP code, posing a significant risk if accounts are compromised.

The vulnerability involves the pfsense.exec_php method within the XMLRPC API. While the vendor disputes the vulnerability status, it allows an authenticated user with administrative privileges (PR:L) to execute arbitrary PHP code on the system.

Successful exploitation allows an attacker who has already compromised administrative credentials to elevate their control to the underlying operating system. The CVSS score of 9.9 reflects that even if the vendor considers this a feature, it represents a massive security risk if the administrative interface is exposed or if credentials are stolen, potentially leading to a complete network bypass.

Immediate Action: Restrict access to the XMLRPC API to trusted management workstations only via firewall rules and ensure strong, multi-factor authentication is enforced for all administrative accounts.

Proactive Monitoring: Audit administrative access logs frequently and monitor for any unexpected usage of the XMLRPC API or unauthorized execution of PHP scripts.

Compensating Controls: Disable the XMLRPC interface entirely if it is not required for synchronization or management purposes within the environment.

Public Exploit Available: Yes — public PoC exists.

Treat this "intended feature" as a critical security risk. Organizations must strictly limit administrative access to the XMLRPC API to prevent unauthorized code execution, as the potential for system-wide compromise is extreme if an attacker gains administrative access to the firewall.