EUVD-2026-87083
GHSA-c2hj-8667-88fr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted DNS request with XSS payload
-
DeliveryPayload stored in pfBlockerNG DNSBL logs
-
ExploitAdmin opens pfBlockerNG report page
-
ExecutionScript runs in admin session
-
PersistPivot to pfSense command execution
-
ImpactAchieve RCE as root on firewall
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the pfBlockerNG package installed and active on pfSense 26.03.1-RELEASE (pfBlockerNG is not part of the base install), with DNS-based blocking/logging (DNSBL) enabled so attacker-controlled DNS hostnames are captured and rendered in the report UI. The attacker delivers the payload unauthenticated via a crafted DNS request, but exploitation is not fully automatic: a pfSense administrator must subsequently view the affected pfBlockerNG report/log page in a browser (UI:R) for the stored script to execute and pivot to command execution using the admin's authenticated session. Limiting factors: the optional package must be present and logging, and an admin must open the affected page. |
| Impact | The published CVSS 3.1 base score is 6.1 (Medium) using the standard reflected/stored XSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which UNDERSTATES the real-world impact. The single authoritative reference - a NetSPI technical writeup titled 'XSS to RCE in pfSense with one DNS request' - demonstrates that the XSS is a delivery primitive that pivots to remote code execution on the firewall itself, consistent with the 'RCE' tag and the scope change (S:C) in the vector. On the positive-risk side: no CISA KEV listing and no EPSS value were supplied, so there is no evidence of widespread or automated exploitation - treat this as a targeted/opportunistic risk rather than a mass-exploited one. On the negative side: the affected asset is a perimeter firewall, so a successful chain yields root-level control of a security control point, and the delivery step is unauthenticated over the network (a crafted DNS request), lowering the bar considerably. The only meaningful brake is UI:R - an administrator must view the pfBlockerNG report/log page - but that is routine operational behavior. Net: higher operational priority than the 6.1 score implies wherever pfBlockerNG is deployed. Note the CPE is a placeholder ('n/a'), so affected-product data must be taken from the description, not the structured feed. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted DNS query whose hostname carries a JavaScript payload; pfBlockerNG's DNSBL/reporting logs the request and later renders the hostname unsanitized in the pfSense admin UI. When an administrator opens the pfBlockerNG report page, the stored script runs in their authenticated session and pivots to command execution on the firewall. A detailed public technical writeup by NetSPI demonstrates the full XSS-to-RCE chain, so working exploit knowledge is publicly available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Stored cross-site scripting in the pfBlockerNG package for Netgate pfSense 26.03.1-RELEASE allows an unauthenticated remote attacker to inject script into a crafted DNS hostname, which is captured by DNSBL logging and later rendered unsafely in the pfBlockerNG report UI, executing in the browser of an administrator who opens the affected page and enabling escalation to command execution through the admin's authenticated session. The published CVSS 3.1 base score of 6.1 (Medium), derived from the standard reflected/stored XSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), understates the real-world impact, which the independent assessment re-scores to integrity and availability High (C:H/I:H/A:H) because the stored script can pivot to arbitrary code execution on the firewall. This is not part of the base pfSense install: pfBlockerNG must be installed and actively logging DNS via DNSBL, and an administrator must subsequently view the affected report/log page, so exploitation is not fully automatic despite the unauthenticated delivery vector (PR:N with UI:R confirmed from the CVSS vector); no confirmed public exploit code or CISA KEV listing was identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis: the input contains no exact fixed pfSense or pfBlockerNG version and no patch reference, so consult the Netgate/pfBlockerNG package repository and the advisory trail (NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-78902, EUVD-2026-87083, and the NetSPI technical write-up https://www.netspi.com/blog/technical-blog/web-application-pentesting/cve-2026-78902-xss-to-rce-in-pfsense-with-one-dns-request/) and apply the updated package as soon as it is published via the pfSense Package Manager. Until a fix is available, the highest-value compensating control is to uninstall or deactivate the pfBlockerNG package if it is not operationally required - this removes the vulnerable report surface entirely, at the cost of losing its IP/DNS blocklisting; if the package must stay, consider disabling DNSBL logging/reporting features that persist and display externally derived hostnames (trade-off: loss of DNS blocklist visibility and reporting), and strictly limit who can reach the pfSense webGUI by restricting management access via firewall rules to trusted administrative subnets or a dedicated management VLAN (trade-off: more constrained administrative workflow). Because exploitation requires an administrator to open the affected pfBlockerNG report page, reduce the attack window by minimizing routine browsing of DNSBL/report pages from general-purpose browsers, reviewing pfBlockerNG logs for anomalous hostnames containing markup or script-like payloads, and monitoring pfSense configuration changes for unexpected privileged actions following admin report views. Where pfSense exposes a configurable security header or CSP control, enabling a strict Content-Security-Policy on the webGUI can limit script execution as a defensive layer, but it should be validated against GUI functionality before relying on it.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pfBlockerNG is an optional third-party package for Netgate's pfSense firewall distribution that implements IP and DNS-based blocklists, including DNSBL (DNS blackhole listing) with logging and reporting of queried or blocked hostnames. The weakness is CWE-79, improper neutralization of input during web page generation ('cross-site scripting'): attacker-supplied DNS hostnames are stored by the package's logging/reporting subsystem and then inserted into pfBlockerNG's administrative report pages without adequate output encoding or sanitization. Because the report UI is served from the pfSense webGUI origin and accessed by an authenticated administrator, script that executes there inherits that privileged session context and can drive privileged pfSense/package endpoints, which is how the XSS chain converts to command execution - consistent with the referenced NetSPI write-up describing XSS-to-RCE 'with one DNS request'. The CVSS 3.1 vector confirms network reachability, low attack complexity, no privileges required (PR:N, so the injection itself is unauthenticated), user interaction required (UI:R, the admin must open the affected report page), and changed scope (S:C) with low confidentiality and integrity impact in the published score; the independent assessment keeps the same vector shape and prerequisites but raises C/I/A to High to reflect the post-exploitation code-execution outcome. Product identification from CPE is unavailable: the supplied CPE is a wildcard placeholder (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and the ENISA EUVD affected-version entries are also 'n/a', so version scoping relies on the description and independent assessment, which pin pfSense 26.03.1-RELEASE with the pfBlockerNG package installed and DNSBL-based blocking/logging enabled.
Know when Pfblockerng gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated DNS delivery (AV:N/AC:L/PR:N) but needs admin to view the report (UI:R); scope change (S:C) to firewall RCE justifies C/I/A:H over the XSS-only 6.1.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Pfblockerng
View allpfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metachar
pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host
Exploit-DB