pfSense

Currently it is possible for anyone with privileges to access the Kea configuration to add or change custom configuration values via JSON fields provided on several areas of DHCPv4 and DHCPv6 pages when using the Kea backend.

There are some Kea directives which allow executing external commands, so allowing access to these fields effectively grants these users full admin/root access.

We had a similar concern with OpenVPN advanced options which we wrapped in an additional privilege check, see #9511

If this is too complex to address on a short timetable we can move it ahead to the next release and put out a patch when it's ready.