Unsafe PHP Deserialization in pfSense Module Installer

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-69690 is a critical code execution vulnerability in Netgate pfSense CE 2.7.2 that exploits unsafe deserialization of PHP objects within backup files processed by the module installer. The vulnerability allows an attacker with administrative access to inject malicious serialized objects containing the post_reboot_commands property, leading to arbitrary PHP code execution on the system. This affects pfSense deployments where administrative accounts may be compromised or where threat actors gain initial access with elevated privileges. While Netgate argues this is intentional functionality for administrators, the unsafe deserialization pattern (CWE-502) represents a significant risk vector when combined with object injection techniques (CWE-915), particularly in scenarios where backup files are processed without proper validation or where administrative credentials are compromised.

Casky's 419 matched skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across the MITRE ATT&CK framework. Practitioners using Casky would identify suspicious activity through Initial Access (TA0001) detection by monitoring for backup file uploads or module installer manipulation. The platform's skills map Defense Evasion (TA0005) patterns—specifically how attackers obfuscate malicious serialized objects within seemingly legitimate backup files. Execution (TA0002) detection focuses on identifying post_reboot_commands processing and PHP code invocation patterns that deviate from normal administrative operations. Security teams would see findings highlighting deserialization of untrusted data, unusual reboot command sequences in logs, and instantiation of unexpected PHP objects—enabling them to distinguish between legitimate admin PHP execution and attacker-controlled code execution before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-69690.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2025-69690

Casky has 419 skills that investigate the attack patterns behind CVE-2025-69690. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn