pfSense CE EUVD-2026-102344

Exploitation requires an authenticated pfSense CE WebGUI account holding either the 'Firewall: Rules' or 'NAT: Port Forward' privilege; the attacker submits a malicious value in the separator[] color field, which display_separator() emits unencoded into an HTML class attribute. Firing the payload additionally requires a higher-privileged administrator to passively load the firewall rules page (UI:P) in an authenticated session. Limiting factors: a valid privileged (non-admin) account is mandatory, victim administrator interaction is required, and only versions 2.3.0 through 2.9.0 are affected - reducing this to an insider/privilege-escalation scenario rather than unauthenticated remote compromise.

This is a genuine but moderate-priority issue rather than an urgent emergency. The CVSS 4.0 base score of 4.8 (Medium) is consistent with the vector: AV:N makes it network-reachable, but PR:H requires the attacker to already hold a privileged WebGUI role (Firewall: Rules or NAT: Port Forward), and UI:P means an administrator must passively view the affected firewall rules page for the payload to fire. Impact is capped at VC:L/VI:L/VA:N - this is a stored XSS that lets a lower-privileged operator escalate by hijacking an administrator's authenticated WebGUI session, not a direct code-execution or data-destruction flaw. A public exploit exists (abraxas/pfsense-separator-color-xss, referenced by VulnCheck), which raises practical likelihood, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active, widespread exploitation. The signals are internally consistent - no contradiction between the network vector and the described web-based attack. The chief limiting factor is the PR:H prerequisite: an attacker needs an existing semi-trusted firewall-admin account, making this primarily an insider/privilege-escalation or lateral-movement concern rather than a mass-exploitable perimeter bug. EPSS data is missing and should be checked before final prioritization.

A pfSense CE operator granted only limited Firewall: Rules or NAT: Port Forward permissions creates a firewall separator and submits a crafted separator[] color value containing a script payload, which display_separator() renders unencoded into a class attribute. When a full administrator later opens the firewall rules page, the stored script executes in their browser and performs WebGUI actions (e.g., creating an admin user or altering rules) with the administrator's privileges. A public proof-of-concept for this exact separator-color vector is available.