Netgate
Monthly
Authorization bypass in Netgate pfSense CE through 2.9.0 allows an authenticated WebGUI account that holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php to replace config.xml despite lacking the 'User - Config: Deny Config Write' privilege; the account can otherwise be read-only. Successful exploitation can yield root-level code execution after a configuration reload or reboot, and publicly available exploit code exists. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.6), reflecting a remote authenticated low-privilege attacker with high confidentiality, integrity, and availability impact.
Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency.
Command injection in Netgate pfSense CE 2.4.5 through 2.9.0 lets an authenticated WebGUI user holding the Advanced Admin Access privilege execute arbitrary commands as root by placing newline or $(...) sequences in the Login Protection (sshguard) threshold, block time, or detection time fields, which are written unvalidated to sshguard.conf and sourced as root when the service restarts. The flaw is privilege-gated rather than mass-exploitable: the CVSS vector specifies PR:H, so only already-administrative accounts can trigger it, with no user interaction required beyond the attacker's own session. Publicly available exploit code exists (referenced in the CVE record), and the root cause is CWE-78 OS command injection.
Authenticated VPN users can execute arbitrary commands as root on pfSense CE through 2.9.0 by exploiting an OS command injection in the OpenVPN connect/disconnect script, openvpn.connect_async.sh. The attack requires a valid VPN account authenticated via RADIUS or LDAP and a username containing single quotes and shell metacharacters that break out of an eval'd pfctl anchor name. Publicly available exploit code exists (reported by VulnCheck), though no active exploitation has been confirmed by CISA KEV. This is a credible high-priority issue for any pfSense CE deployment that uses OpenVPN with external authentication.
Command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated administrator who holds IPsec Mobile configuration privileges store a crafted single-line login banner that escapes the unquoted strongswan.conf attr value and injects charon.start-scripts entries, resulting in command execution as root on the firewall. Exploitation is gated by high privilege (PR:H) and by a charon restart precondition - the injected payload only runs when the strongSwan daemon is restarted, not at submission time - but publicly available exploit code exists and the impact on confidentiality, integrity, and availability is high. This is a genuine high-priority issue for organizations running affected pfSense CE firewalls, but its exploitation is gated by privilege rather than exposure, and no unauthenticated or unprivileged path has been identified.
Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected.
Authenticated pfSense CE WebGUI users holding L2TP Server or PPPoE Server edit privileges can inject mpd5 commands - including an up-script that executes as root - by submitting a RADIUS shared secret that contains a quote and newline. The weakness affects pfSense CE through 2.9.0 and requires a RADIUS-backed VPN configuration that actually starts a session for execution; publicly available exploit code exists, but CISA KEV does not list this CVE and no confirmed active exploitation has been reported. This is a genuine but access-gated code execution issue rather than a mass-exploitation threat.
Root command execution on pfSense CE through 2.9.0 is achievable by authenticated attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege, who inject newline characters into the ptpid or PPP periodic-reset hour/minute fields of interfaces_ppps_edit.php. The injected newlines are written unescaped into /etc/crontab by configure_cron(), causing scheduled root command execution. Publicly available exploit code exists; CISA KEV does not list this CVE, and no public exploit activity has been confirmed. CVSS 4.0 score is 8.6 (PR:H), and an independent assessment concurs with high impact but notes this is a credentialed privilege-escalation-to-root flaw rather than a pre-auth mass-exploitation threat.
Command injection in pfSense CE through 2.9.0 allows authenticated users with the PPPoE Server Edit privilege to inject newline characters into the username field, causing mpd5 to run arbitrary commands as root when a PPPoE client authenticates. The flaw resides in services_pppoe_edit.php, which fails to sanitize the username POST field (CWE-93). Public exploit code exists, but exploitation requires an enabled PPPoE server and a subsequent client authentication event, limiting this to a post-authentication privilege-escalation attack.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated web GUI user who holds the Traffic Shaper Limiters privilege execute arbitrary commands as root, turning a narrowly delegated configuration permission into full appliance compromise. The flaw is triggered when an operator edits a limiter and injects a crafted hidden 'number' value and then deletes that limiter, causing delete_queue() to pass the unquoted, attacker-controlled value to dnctl via /bin/sh running as root. Publicly available exploit code exists (VulnCheck advisory plus Abraxas Labs research and a PoC repository), and while the issue is not listed in CISA KEV as actively exploited, exploitation is gated on prior authenticated access with the Limiters privilege (PR:H) and on the attacker completing the limiter edit-then-delete workflow.
Command injection in Netgate pfSense CE through 2.9.0 allows an authenticated user with Virtual IP (CARP) edit privileges to execute commands as root by storing a malicious VHID value that is later interpolated into ifconfig calls or CARP status rendering. Publicly available exploit code exists, and the independent assessment rates this as a privilege-gated high-impact issue rather than an unauthenticated remote compromise; CISA KEV does not confirm active exploitation in the supplied data. Affected deployments are those where administrators or delegated operators can create or modify CARP VIPs, narrowing realistic risk to insiders or attackers who already hold privileged firewall UI access.
OS command injection in Netgate pfSense CE (through 2.9.0) allows remote attackers holding an authenticated web-GUI account with gateway edit privileges to execute arbitrary commands as root by planting shell metacharacters in the zone index of an IPv6 link-local gateway Monitor IP, which start_dpinger() passes unescaped into the dpinger shell command when gateway monitoring is applied. Exploitation requires high privileges (CVSS 4.0 PR:H) and no victim interaction (UI:N), but yields high confidentiality, integrity and availability impact on the firewall itself; publicly available exploit code exists (abraxas/pfsense-gw-ipv6-zone) with no confirmed active exploitation reported. This is a genuine but access-gated priority: unauthenticated or low-privileged users cannot reach the vulnerable gateway-edit path, so exposure is limited to deployments where such configuration rights are delegated.
Command injection in Netgate pfSense CE through 2.9.0 allows remote authenticated users with limited 'Wireless Edit' or 'Interface Assignments' GUI privileges to execute arbitrary commands as root. The flaw is triggered by supplying a crafted wireless parent interface name such as ath0;<cmd> through interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. Publicly available exploit code exists, and the assessed impact is high for confidentiality, integrity, and availability, though exploitation requires valid credentials with one of those specific privileges and access to the management interface.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 allows an authenticated web-interface user who holds the QinQ edit privilege to execute arbitrary commands as root. The attacker saves a crafted parent interface ('if') value and then re-edits the QinQ entry, causing that unvalidated value to be interpolated into an ifconfig shell command; publicly available exploit code exists, and no confirmed active exploitation (CISA KEV) has been reported. The principal constraint is the high privilege requirement - only operators already trusted with interface configuration can reach the vulnerable code path - and risk is further reduced where the management UI is not exposed to untrusted networks or lower-privileged users.
OS command injection in the pfSense-pkg-frr package (2.0.2_1 and source revision 2.1.2_1) lets an authenticated WebGUI user holding only the low-privilege page-status-frr role execute arbitrary commands as root on the firewall. The flaw sits in the FRR status filter on status_frr.php, where a crafted filter value escapes a single-quoted sed expression that concatenates escapeshellarg() output before being evaluated through a popen() pipeline. Exploitation requires the optional FRR package to be installed plus a valid authenticated session with the page-status-frr privilege (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8), so it is a post-authentication privilege escalation rather than a pre-auth compromise; there is no public exploit identified at time of analysis, and no CISA KEV listing. Updated FRR packages resolve the issue for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
PHP code execution on Netgate pfSense Plus and pfSense CE firewalls can be achieved by an authenticated, highly privileged webGUI user who can modify Dashboard widget settings and plant a crafted .widget.php file on the filesystem, then set a widget sequence value containing path traversal so Dashboard index.php include()s and executes that file. The vendor rates this High (CVSS 8.5), while the independent assessment keeps AV:N/AC:H but raises the privilege requirement to PR:H, reflecting that the attacker already needs substantial Dashboard and file-write access; it is not remotely exploitable without authentication. No public exploit or KEV-listed active exploitation was identified in the provided data, and Netgate has released fixed versions.
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting in Netgate pfSense CE 2.7.1 through 2.9.0 allows unauthenticated remote attackers to inject script into the WebGUI via the unencoded 'if' parameter in firewall_rules.php, but only when the non-default 'Require Firewall Interface' option is enabled and a privileged operator is lured into opening a crafted GET link. Publicly available exploit code exists, yet the vulnerability is a low-priority issue because exploitation requires a non-default configuration, user interaction, and a victim who already holds firewall-rules privileges, with impact confined to that victim's session.
Stored cross-site scripting in Netgate pfSense CE 2.3.0 through 2.9.0 lets an authenticated WebGUI user who holds the Firewall: Rules or NAT: Port Forward privilege plant a crafted separator[] color value that display_separator() writes unencoded into an HTML class attribute, so the payload executes in the browser of any administrator who subsequently opens the firewall rules or port-forward page. Because the script runs inside that administrator's authenticated session, it can drive WebGUI actions at the higher privilege level; publicly available exploit code exists, but there is no CISA KEV entry, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) frames this as a moderate, insider-flavoured privilege-escalation issue rather than an urgent unauthenticated compromise.
Local file read in Netgate pfSense CE through 2.9.0 allows an authenticated user who holds the Dynamic DNS client privilege to cause root-readable files such as /conf/config.xml or /etc/master.passwd to be written into the system log. The attacker configures a custom DynDNS provider with a file:// Update URL and a deliberately non-matching Result Match value, so the _checkStatus() routine logs the fetched content as root. Publicly available exploit code exists, but exploitation is privilege-gated: it requires access to services_dyndns_edit.php with the Dynamic DNS client privilege, and independent assessment confirms only confidentiality impact with no integrity or availability effect, making this a credible but limited information-disclosure risk rather than a mass-exploitation threat.
CRLF injection in Netgate pfSense CE 2.7.1 through 2.9.0 allows authenticated users with the 'DNS Resolver: Advanced' privilege to inject arbitrary Unbound directives via the sock_queue_timeout parameter. This can override local DNS records and forwarding for all clients, impacting integrity and availability. Publicly available exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 5.1).
Authenticated pfSense CE users holding the 'DNS Resolver: Access Lists' privilege can embed CR/LF characters in the aclname or aclaction fields of an Unbound access list, causing attacker-supplied Unbound directives (local-data, local-zone, forward-zone) to be written into access_lists.conf and letting the attacker control which DNS answers are served to LAN clients. All pfSense CE versions through 2.9.0 are affected (CPE cpe:2.3:a:netgate:pfsense_ce:*), the root cause is CWE-93 (improper neutralization of CRLF sequences), and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Because the CVSS vector requires PR:H, exploitation demands an authenticated account with a specific, highly privileged DNS configuration role, so realistic risk is insider misuse or abuse of a compromised privileged session rather than opportunistic external attack - a genuine but bounded-priority issue rather than an emergency.
OS command injection in Netgate pfSense CE 2.5.0 through 2.9.0 allows an authenticated OpenVPN client to run arbitrary shell commands as the low-privileged 'unbound' user by embedding shell metacharacters in the certificate common name or username that openvpn.learn-address.sh interpolates unquoted into a 'su -c' string. Exploitation requires three conditions to line up: valid VPN authentication (the CVSS vector is PR:L, so authenticated), the non-default 'DNS Resolver (unbound) client registration' feature enabled, and attacker-controlled CN or username - which is why the assessed severity is low (CVSS 2.3 in the v4 vector supplied; equivalent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). Publicly available exploit code exists; there is no confirmation of active exploitation (not in CISA KEV) and impact is confined to the unbound user rather than root, so this is a genuine but low-priority issue.
Stored cross-site scripting in the pfBlockerNG package for Netgate pfSense 26.03.1-RELEASE allows an unauthenticated remote attacker to inject script into a crafted DNS hostname, which is captured by DNSBL logging and later rendered unsafely in the pfBlockerNG report UI, executing in the browser of an administrator who opens the affected page and enabling escalation to command execution through the admin's authenticated session. The published CVSS 3.1 base score of 6.1 (Medium), derived from the standard reflected/stored XSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), understates the real-world impact, which the independent assessment re-scores to integrity and availability High (C:H/I:H/A:H) because the stored script can pivot to arbitrary code execution on the firewall. This is not part of the base pfSense install: pfBlockerNG must be installed and actively logging DNS via DNSBL, and an administrator must subsequently view the affected report/log page, so exploitation is not fully automatic despite the unauthenticated delivery vector (PR:N with UI:R confirmed from the CVSS vector); no confirmed public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in pfSense Plus before 26.07 and CE before 2.9.0 allows an authenticated attacker holding the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the schedule description field in /firewall_schedule_edit.php. The description is written to backend storage without HTML sanitization, and when rendered in /firewall_rules.php only single-quote escaping is applied - insufficient to prevent double-quote-based breakout from an HTML attribute context. Any pfSense administrator with the Firewall: Rules privilege who views the rules list while the malicious schedule is attached will silently execute the attacker's payload, enabling session token theft or in-browser privilege escalation within the firewall management interface.
Stored cross-site scripting in pfSense Plus and pfSense CE allows an authenticated attacker holding the 'Firewall: Rules: Edit' privilege to inject arbitrary JavaScript via the `descr` parameter in `/firewall_rules_edit.php`. The injected payload is written to the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered unencoded in the firewall log table at `/status_logs_filter.php`, executing in the browser of any administrator holding the 'Status: Logs: Firewall' privilege who views the affected entries. Patches are available in pfSense Plus 26.07 and pfSense CE 2.9.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in pfSense Plus before 26.07 and pfSense CE before 2.9.0 allows an authenticated user holding only the Status: Monitoring privilege to inject arbitrary JavaScript via unsanitized graph configuration POST parameters in /status_monitoring.php. The payload is persisted in the global pfSense XML configuration file and rendered unsanitized into a JavaScript string context, meaning it executes automatically in the browser of every subsequent visitor to the Status: Monitoring page - including full administrators. Vendor-released patches exist in pfSense Plus 26.07 and CE 2.9.0; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in pfSense Plus (before 26.07) and pfSense CE (through 2.8.1) allows an external attacker who controls a DNS PTR record to execute arbitrary JavaScript in an administrator's browser by engineering top-talker visibility in the Traffic Graphs feature, ultimately enabling account creation and OS command execution on the firewall. The attack chain bridges an unauthenticated DNS-layer injection through an unsanitized DOM sink in AJAX responses to full authenticated control of the management interface. No public exploit has been identified at time of analysis, but successful exploitation yields complete administrative compromise of a network perimeter device - making this a high-impact target despite its moderate CVSS 4.0 score of 5.3.
Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in pfSense through 2.4.4-p3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An XSS issue was discovered in pfSense through 2.4.4-p3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) use_mfs_tmp_size, or (3). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php;. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the descr parameter in a "new" action to system_authservers.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 34.6%.
Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Authorization bypass in Netgate pfSense CE through 2.9.0 allows an authenticated WebGUI account that holds page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php to replace config.xml despite lacking the 'User - Config: Deny Config Write' privilege; the account can otherwise be read-only. Successful exploitation can yield root-level code execution after a configuration reload or reboot, and publicly available exploit code exists. The independent assessment scores this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.6), reflecting a remote authenticated low-privilege attacker with high confidentiality, integrity, and availability impact.
Command injection in pfSense CE 2.7.0 through 2.9.0 allows authenticated users who hold only the Captive Portal HA privilege to execute commands as root by manipulating backwardsyncip to point at an attacker-controlled XMLRPC server and returning connected_users entries with shell metacharacters in ip or mac fields. Exploitation is privilege-gated: it requires the specific Captive Portal HA WebGUI permission, use of Captive Portal high-availability sync, and the ability to influence the synced connected_users data. Publicly available exploit code exists, but no CISA KEV confirmed active exploitation is identified; this is a credible privilege-gated priority rather than a mass-exploitation emergency.
Command injection in Netgate pfSense CE 2.4.5 through 2.9.0 lets an authenticated WebGUI user holding the Advanced Admin Access privilege execute arbitrary commands as root by placing newline or $(...) sequences in the Login Protection (sshguard) threshold, block time, or detection time fields, which are written unvalidated to sshguard.conf and sourced as root when the service restarts. The flaw is privilege-gated rather than mass-exploitable: the CVSS vector specifies PR:H, so only already-administrative accounts can trigger it, with no user interaction required beyond the attacker's own session. Publicly available exploit code exists (referenced in the CVE record), and the root cause is CWE-78 OS command injection.
Authenticated VPN users can execute arbitrary commands as root on pfSense CE through 2.9.0 by exploiting an OS command injection in the OpenVPN connect/disconnect script, openvpn.connect_async.sh. The attack requires a valid VPN account authenticated via RADIUS or LDAP and a username containing single quotes and shell metacharacters that break out of an eval'd pfctl anchor name. Publicly available exploit code exists (reported by VulnCheck), though no active exploitation has been confirmed by CISA KEV. This is a credible high-priority issue for any pfSense CE deployment that uses OpenVPN with external authentication.
Command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated administrator who holds IPsec Mobile configuration privileges store a crafted single-line login banner that escapes the unquoted strongswan.conf attr value and injects charon.start-scripts entries, resulting in command execution as root on the firewall. Exploitation is gated by high privilege (PR:H) and by a charon restart precondition - the injected payload only runs when the strongSwan daemon is restarted, not at submission time - but publicly available exploit code exists and the impact on confidentiality, integrity, and availability is high. This is a genuine high-priority issue for organizations running affected pfSense CE firewalls, but its exploitation is gated by privilege rather than exposure, and no unauthenticated or unprivileged path has been identified.
Authenticated pfSense CE administrators with General Setup privileges can achieve root-level PHP code execution by injecting an auto_prepend_file directive into php.ini through an unvalidated timezone value. Publicly available exploit code exists, but exploitation is conditional: the injected directive only runs after php.ini is regenerated at boot or on a php-fpm restart, and the attacker already holds administrator-equivalent access, making this a post-authentication privilege escalation rather than an unauthenticated remote compromise or mass-exploitation threat. Netgate pfSense CE through 2.9.0 is affected.
Authenticated pfSense CE WebGUI users holding L2TP Server or PPPoE Server edit privileges can inject mpd5 commands - including an up-script that executes as root - by submitting a RADIUS shared secret that contains a quote and newline. The weakness affects pfSense CE through 2.9.0 and requires a RADIUS-backed VPN configuration that actually starts a session for execution; publicly available exploit code exists, but CISA KEV does not list this CVE and no confirmed active exploitation has been reported. This is a genuine but access-gated code execution issue rather than a mass-exploitation threat.
Root command execution on pfSense CE through 2.9.0 is achievable by authenticated attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege, who inject newline characters into the ptpid or PPP periodic-reset hour/minute fields of interfaces_ppps_edit.php. The injected newlines are written unescaped into /etc/crontab by configure_cron(), causing scheduled root command execution. Publicly available exploit code exists; CISA KEV does not list this CVE, and no public exploit activity has been confirmed. CVSS 4.0 score is 8.6 (PR:H), and an independent assessment concurs with high impact but notes this is a credentialed privilege-escalation-to-root flaw rather than a pre-auth mass-exploitation threat.
Command injection in pfSense CE through 2.9.0 allows authenticated users with the PPPoE Server Edit privilege to inject newline characters into the username field, causing mpd5 to run arbitrary commands as root when a PPPoE client authenticates. The flaw resides in services_pppoe_edit.php, which fails to sanitize the username POST field (CWE-93). Public exploit code exists, but exploitation requires an enabled PPPoE server and a subsequent client authentication event, limiting this to a post-authentication privilege-escalation attack.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 lets an authenticated web GUI user who holds the Traffic Shaper Limiters privilege execute arbitrary commands as root, turning a narrowly delegated configuration permission into full appliance compromise. The flaw is triggered when an operator edits a limiter and injects a crafted hidden 'number' value and then deletes that limiter, causing delete_queue() to pass the unquoted, attacker-controlled value to dnctl via /bin/sh running as root. Publicly available exploit code exists (VulnCheck advisory plus Abraxas Labs research and a PoC repository), and while the issue is not listed in CISA KEV as actively exploited, exploitation is gated on prior authenticated access with the Limiters privilege (PR:H) and on the attacker completing the limiter edit-then-delete workflow.
Command injection in Netgate pfSense CE through 2.9.0 allows an authenticated user with Virtual IP (CARP) edit privileges to execute commands as root by storing a malicious VHID value that is later interpolated into ifconfig calls or CARP status rendering. Publicly available exploit code exists, and the independent assessment rates this as a privilege-gated high-impact issue rather than an unauthenticated remote compromise; CISA KEV does not confirm active exploitation in the supplied data. Affected deployments are those where administrators or delegated operators can create or modify CARP VIPs, narrowing realistic risk to insiders or attackers who already hold privileged firewall UI access.
OS command injection in Netgate pfSense CE (through 2.9.0) allows remote attackers holding an authenticated web-GUI account with gateway edit privileges to execute arbitrary commands as root by planting shell metacharacters in the zone index of an IPv6 link-local gateway Monitor IP, which start_dpinger() passes unescaped into the dpinger shell command when gateway monitoring is applied. Exploitation requires high privileges (CVSS 4.0 PR:H) and no victim interaction (UI:N), but yields high confidentiality, integrity and availability impact on the firewall itself; publicly available exploit code exists (abraxas/pfsense-gw-ipv6-zone) with no confirmed active exploitation reported. This is a genuine but access-gated priority: unauthenticated or low-privileged users cannot reach the vulnerable gateway-edit path, so exposure is limited to deployments where such configuration rights are delegated.
Command injection in Netgate pfSense CE through 2.9.0 allows remote authenticated users with limited 'Wireless Edit' or 'Interface Assignments' GUI privileges to execute arbitrary commands as root. The flaw is triggered by supplying a crafted wireless parent interface name such as ath0;<cmd> through interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command. Publicly available exploit code exists, and the assessed impact is high for confidentiality, integrity, and availability, though exploitation requires valid credentials with one of those specific privileges and access to the management interface.
OS command injection in Netgate pfSense CE 2.7.0 through 2.9.0 allows an authenticated web-interface user who holds the QinQ edit privilege to execute arbitrary commands as root. The attacker saves a crafted parent interface ('if') value and then re-edits the QinQ entry, causing that unvalidated value to be interpolated into an ifconfig shell command; publicly available exploit code exists, and no confirmed active exploitation (CISA KEV) has been reported. The principal constraint is the high privilege requirement - only operators already trusted with interface configuration can reach the vulnerable code path - and risk is further reduced where the management UI is not exposed to untrusted networks or lower-privileged users.
OS command injection in the pfSense-pkg-frr package (2.0.2_1 and source revision 2.1.2_1) lets an authenticated WebGUI user holding only the low-privilege page-status-frr role execute arbitrary commands as root on the firewall. The flaw sits in the FRR status filter on status_frr.php, where a crafted filter value escapes a single-quoted sed expression that concatenates escapeshellarg() output before being evaluated through a popen() pipeline. Exploitation requires the optional FRR package to be installed plus a valid authenticated session with the page-status-frr privilege (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8), so it is a post-authentication privilege escalation rather than a pre-auth compromise; there is no public exploit identified at time of analysis, and no CISA KEV listing. Updated FRR packages resolve the issue for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
PHP code execution on Netgate pfSense Plus and pfSense CE firewalls can be achieved by an authenticated, highly privileged webGUI user who can modify Dashboard widget settings and plant a crafted .widget.php file on the filesystem, then set a widget sequence value containing path traversal so Dashboard index.php include()s and executes that file. The vendor rates this High (CVSS 8.5), while the independent assessment keeps AV:N/AC:H but raises the privilege requirement to PR:H, reflecting that the attacker already needs substantial Dashboard and file-write access; it is not remotely exploitable without authentication. No public exploit or KEV-listed active exploitation was identified in the provided data, and Netgate has released fixed versions.
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected cross-site scripting in Netgate pfSense CE 2.7.1 through 2.9.0 allows unauthenticated remote attackers to inject script into the WebGUI via the unencoded 'if' parameter in firewall_rules.php, but only when the non-default 'Require Firewall Interface' option is enabled and a privileged operator is lured into opening a crafted GET link. Publicly available exploit code exists, yet the vulnerability is a low-priority issue because exploitation requires a non-default configuration, user interaction, and a victim who already holds firewall-rules privileges, with impact confined to that victim's session.
Stored cross-site scripting in Netgate pfSense CE 2.3.0 through 2.9.0 lets an authenticated WebGUI user who holds the Firewall: Rules or NAT: Port Forward privilege plant a crafted separator[] color value that display_separator() writes unencoded into an HTML class attribute, so the payload executes in the browser of any administrator who subsequently opens the firewall rules or port-forward page. Because the script runs inside that administrator's authenticated session, it can drive WebGUI actions at the higher privilege level; publicly available exploit code exists, but there is no CISA KEV entry, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) frames this as a moderate, insider-flavoured privilege-escalation issue rather than an urgent unauthenticated compromise.
Local file read in Netgate pfSense CE through 2.9.0 allows an authenticated user who holds the Dynamic DNS client privilege to cause root-readable files such as /conf/config.xml or /etc/master.passwd to be written into the system log. The attacker configures a custom DynDNS provider with a file:// Update URL and a deliberately non-matching Result Match value, so the _checkStatus() routine logs the fetched content as root. Publicly available exploit code exists, but exploitation is privilege-gated: it requires access to services_dyndns_edit.php with the Dynamic DNS client privilege, and independent assessment confirms only confidentiality impact with no integrity or availability effect, making this a credible but limited information-disclosure risk rather than a mass-exploitation threat.
CRLF injection in Netgate pfSense CE 2.7.1 through 2.9.0 allows authenticated users with the 'DNS Resolver: Advanced' privilege to inject arbitrary Unbound directives via the sock_queue_timeout parameter. This can override local DNS records and forwarding for all clients, impacting integrity and availability. Publicly available exploit code exists, and the issue is rated medium severity (CVSS 4.0 base 5.1).
Authenticated pfSense CE users holding the 'DNS Resolver: Access Lists' privilege can embed CR/LF characters in the aclname or aclaction fields of an Unbound access list, causing attacker-supplied Unbound directives (local-data, local-zone, forward-zone) to be written into access_lists.conf and letting the attacker control which DNS answers are served to LAN clients. All pfSense CE versions through 2.9.0 are affected (CPE cpe:2.3:a:netgate:pfsense_ce:*), the root cause is CWE-93 (improper neutralization of CRLF sequences), and publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation. Because the CVSS vector requires PR:H, exploitation demands an authenticated account with a specific, highly privileged DNS configuration role, so realistic risk is insider misuse or abuse of a compromised privileged session rather than opportunistic external attack - a genuine but bounded-priority issue rather than an emergency.
OS command injection in Netgate pfSense CE 2.5.0 through 2.9.0 allows an authenticated OpenVPN client to run arbitrary shell commands as the low-privileged 'unbound' user by embedding shell metacharacters in the certificate common name or username that openvpn.learn-address.sh interpolates unquoted into a 'su -c' string. Exploitation requires three conditions to line up: valid VPN authentication (the CVSS vector is PR:L, so authenticated), the non-default 'DNS Resolver (unbound) client registration' feature enabled, and attacker-controlled CN or username - which is why the assessed severity is low (CVSS 2.3 in the v4 vector supplied; equivalent CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L per independent assessment). Publicly available exploit code exists; there is no confirmation of active exploitation (not in CISA KEV) and impact is confined to the unbound user rather than root, so this is a genuine but low-priority issue.
Stored cross-site scripting in the pfBlockerNG package for Netgate pfSense 26.03.1-RELEASE allows an unauthenticated remote attacker to inject script into a crafted DNS hostname, which is captured by DNSBL logging and later rendered unsafely in the pfBlockerNG report UI, executing in the browser of an administrator who opens the affected page and enabling escalation to command execution through the admin's authenticated session. The published CVSS 3.1 base score of 6.1 (Medium), derived from the standard reflected/stored XSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), understates the real-world impact, which the independent assessment re-scores to integrity and availability High (C:H/I:H/A:H) because the stored script can pivot to arbitrary code execution on the firewall. This is not part of the base pfSense install: pfBlockerNG must be installed and actively logging DNS via DNSBL, and an administrator must subsequently view the affected report/log page, so exploitation is not fully automatic despite the unauthenticated delivery vector (PR:N with UI:R confirmed from the CVSS vector); no confirmed public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in pfSense Plus before 26.07 and CE before 2.9.0 allows an authenticated attacker holding the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the schedule description field in /firewall_schedule_edit.php. The description is written to backend storage without HTML sanitization, and when rendered in /firewall_rules.php only single-quote escaping is applied - insufficient to prevent double-quote-based breakout from an HTML attribute context. Any pfSense administrator with the Firewall: Rules privilege who views the rules list while the malicious schedule is attached will silently execute the attacker's payload, enabling session token theft or in-browser privilege escalation within the firewall management interface.
Stored cross-site scripting in pfSense Plus and pfSense CE allows an authenticated attacker holding the 'Firewall: Rules: Edit' privilege to inject arbitrary JavaScript via the `descr` parameter in `/firewall_rules_edit.php`. The injected payload is written to the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered unencoded in the firewall log table at `/status_logs_filter.php`, executing in the browser of any administrator holding the 'Status: Logs: Firewall' privilege who views the affected entries. Patches are available in pfSense Plus 26.07 and pfSense CE 2.9.0; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in pfSense Plus before 26.07 and pfSense CE before 2.9.0 allows an authenticated user holding only the Status: Monitoring privilege to inject arbitrary JavaScript via unsanitized graph configuration POST parameters in /status_monitoring.php. The payload is persisted in the global pfSense XML configuration file and rendered unsanitized into a JavaScript string context, meaning it executes automatically in the browser of every subsequent visitor to the Status: Monitoring page - including full administrators. Vendor-released patches exist in pfSense Plus 26.07 and CE 2.9.0; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in pfSense Plus (before 26.07) and pfSense CE (through 2.8.1) allows an external attacker who controls a DNS PTR record to execute arbitrary JavaScript in an administrator's browser by engineering top-talker visibility in the Traffic Graphs feature, ultimately enabling account creation and OS command execution on the firewall. The attack chain bridges an unauthenticated DNS-layer injection through an unsanitized DOM sink in AJAX responses to full authenticated control of the management interface. No public exploit has been identified at time of analysis, but successful exploitation yields complete administrative compromise of a network perimeter device - making this a high-impact target despite its moderate CVSS 4.0 score of 5.3.
Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in pfSense through 2.4.4-p3. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
An XSS issue was discovered in pfSense through 2.4.4-p3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
pfSense through 2.3.4 through 2.4.4-p3 allows Remote Code Injection via a methodCall XML document with a pfsense.exec_php call containing shell metacharacters in a parameter value. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an Arbitrary Command Execution issue in apcupsd_status.php. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters "ifdescr". Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the server[] parameter to services_ntpd.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) use_mfs_tmp_size, or (3). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) proxypass parameter to system_advanced_misc.php;. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the descr parameter in a "new" action to system_authservers.php. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Cross-site scripting (XSS) vulnerability in the WebGUI in pfSense before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the zone parameter in a del action to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 34.6%.
Multiple cross-site scripting (XSS) vulnerabilities in the WebGUI in pfSense before 2.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) zone parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. Rated high severity (CVSS 7.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple open redirect vulnerabilities in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple open redirect vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in suricata_select_alias.php in the Suricata package before 1.0.6 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the Snort package before 3.0.13 for pfSense through 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the eng. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
pfSense before 2.1.4, when HTTP is used, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Session fixation vulnerability in pfSense before 2.1.4 allows remote attackers to hijack web sessions via a firewall login cookie. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple directory traversal vulnerabilities in pfSense before 2.1.4 allow (1) remote attackers to read arbitrary .info files via a crafted path in the pkg parameter to pkg_mgr_install.php and allow. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Absolute path traversal vulnerability in pkg_edit.php in pfSense before 2.1.4 allows remote attackers to read arbitrary XML files via a full pathname in the xml parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
pfSense before 2.1.4 allows remote authenticated users to execute arbitrary commands via (1) the hostname value to diag_dns.php in a Create Alias action, (2) the smartmonemail value to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via (1) the starttime0 parameter to firewall_schedule.php,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.