An authenticated local file inclusion vulnerability in Netgate pfSense allows for arbitrary code execution, posing a significant risk to firewall integrity and network security.

This is a path traversal (CWE-24) vulnerability located in the Dashboard index.php widget handling. An attacker with authenticated access to modify dashboard settings can inject a path traversal payload into the widget sequence, forcing the system to execute unauthorized PHP files.

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the firewall appliance. Given the position of a firewall as a critical security boundary, this compromise could lead to full network exposure, data interception, and total loss of administrative control over the perimeter. The high CVSS score of 8.5 reflects the severity of allowing code execution on a security-critical device.

Immediate Action: Update Netgate pfSense Plus to version 26.07 or later, or Netgate pfSense CE to version 2.9.0 or later, as specified in the official vendor advisory.

Proactive Monitoring: Review firewall administrative logs for unusual widget configuration changes or access to unexpected file paths in the /tmp directory.

Compensating Controls: Restrict administrative access to the pfSense web interface to trusted internal IP addresses only, and enforce the principle of least privilege for all administrative accounts.

Public Exploit Available: Unknown

This vulnerability represents a high-severity risk to network infrastructure. Administrators should prioritize upgrading their pfSense instances to the patched versions immediately to eliminate the possibility of arbitrary code execution via the dashboard interface.