pfSense CVE-2026-67189

Three specific conditions must be simultaneously satisfied. First, the attacker must control authoritative DNS PTR records for one or more IP addresses they can use as a traffic source - requiring either ownership of the IP range, control of the authoritative reverse-DNS zone, or ISP-level DNS manipulation. Second, the attacker must generate traffic from that IP in sufficient volume to rank among the top talkers visible in pfSense Traffic Graphs - a threshold-based condition requiring sustained or burst-level network activity; the exact threshold depends on baseline traffic on the monitored interface. Third, an authenticated pfSense administrator must navigate to the Traffic Graphs page while the malicious PTR record is present in the top-talkers list, constituting required passive user interaction (UI:P in the provided CVSS 4.0 vector). The Traffic Graphs feature with reverse DNS resolution must be active, which should be verified per deployment. Exploitation is bounded by: the DNS PTR control requirement (rules out passive bystanders), the traffic volume threshold (non-trivial for low-traffic environments), and administrator interaction (no exploitation without an active admin session viewing the affected page).

Despite the vendor-assigned CVSS 4.0 score of 5.3, real-world impact is substantially higher than the score implies. The provided CVSS 4.0 vector rates subsequent system impact as Low for both confidentiality and integrity (SC:L/SI:L), but the CVE description explicitly states full authenticated session access, account creation, and arbitrary OS command execution on the firewall - a complete perimeter device compromise. This is a significant inconsistency: the score treats the firewall management interface as a low-value subsequent system when it is, in practice, the primary high-value target. EPSS data was not provided, so exploitation probability cannot be quantified. KEV status is negative - no confirmed active exploitation at time of analysis. No public proof-of-concept exploit has been identified. Attack complexity is genuinely non-trivial: the attacker must control authoritative DNS for their IP range, and must generate sufficient traffic volume to rank in the top-talkers list, which requires either sustained high-volume activity or exploitation during a natural traffic event such as a DDoS. However, a motivated threat actor targeting firewall infrastructure - where the payoff is full network perimeter control - would find this chain attractive. The CVSS 4.0 vector's AT:N rating appears to underweight the top-talker threshold prerequisite, which constitutes a real attack requirement beyond standard network access.

An attacker sets up authoritative DNS for their IP block and configures a PTR record containing a JavaScript payload such as an iframe, credential exfiltrator, or WebSocket-based backdoor. They then generate high-volume traffic through or toward the pfSense firewall - via a sustained scan, reflection attack originating from their IP, or coordinated flood - sufficient to appear in the Traffic Graphs top-talkers list. When an administrator navigates to the Traffic Graphs page, the unsanitized PTR record is injected into the DOM, executing the attacker's JavaScript in the admin's authenticated browser session, from which they can invoke the pfSense management API to create backdoor accounts or execute OS commands on the firewall host.