pfSense CVE-2026-56127

The attacker must be authenticated to the pfSense web UI and hold the explicitly granted 'Firewall: Rules: Edit' privilege - this is a non-default, administrator-assigned role. Payload execution requires a second, separately authenticated user holding the 'Status: Logs: Firewall' privilege to view the firewall log table at /status_logs_filter.php after the malicious rule is created. Exploitation is therefore limited to multi-administrator pfSense deployments where role-based privilege delegation is in use. Single-admin environments (one account with full privileges) present no exploitable cross-privilege boundary. Both pfSense Plus (before 26.07) and pfSense CE (before 2.9.0) must be running vulnerable versions. There is no requirement for any non-default network configuration or special protocol - the attack path is entirely through the standard HTTPS web UI.

The CVSS 4.0 score of 5.1 (Medium) accurately captures the constrained exploitation path: the attacker must be authenticated with the specific 'Firewall: Rules: Edit' privilege (PR:L), and payload execution requires a second privileged victim with 'Status: Logs: Firewall' access to view the log table (UI:P). The impact is confined to the victim's browser session - SC:L and SI:L in CVSS 4.0 terms - with no direct compromise of the pfSense system itself. In multi-administrator deployments relying on role-based privilege separation, this represents a meaningful lateral-escalation path: a lower-privileged operator can target a higher-privileged administrator's session to steal tokens or perform admin actions on their behalf. In single-admin deployments, no meaningful privilege boundary exists to cross, reducing real-world impact significantly. No EPSS score is provided in the input data, no CISA KEV listing exists, and no public PoC has been identified. The risk is real but narrow: it matters most in organizations that delegate pfSense management across multiple accounts with differing trust levels.

An attacker with a lower-privileged pfSense account holding 'Firewall: Rules: Edit' access creates a firewall rule whose description contains a JavaScript payload (e.g., a cookie-stealing script) via /firewall_rules_edit.php. When a higher-privileged administrator with 'Status: Logs: Firewall' access subsequently opens the firewall log table at /status_logs_filter.php, the stored payload executes in their browser, potentially harvesting their session token or silently performing administrative actions in their name. No public PoC has been identified, but the attack path is well-described and straightforward to replicate from the disclosure.