CVE-2026-111233 in pfSense CE
Summary
by MITRE • 10/15/2026
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Netgate pfSense Community Edition versions 2.7.1 through 2.9.0 represents a significant security flaw within the web-based management interface, specifically located in the firewall_rules.php module. This is classified as a reflected cross-site scripting (XSS) vulnerability that stems from insufficient input validation and output encoding mechanisms when processing user-supplied data. The core technical failure occurs during the handling of the if parameter, which corresponds to the network interface selection within the firewall rule configuration page. When this parameter receives input containing malicious script payloads, the application fails to properly encode or sanitize these characters before rendering them in the HTML response sent back to the client browser. This lack of sanitization allows arbitrary JavaScript code to be injected directly into the context of the web page, bypassing standard security controls that rely on proper character escaping.
The operational impact of this vulnerability is particularly severe due to its reliance on social engineering and specific configuration states within the pfSense environment. The attack vector requires a non-default setting known as Require Firewall Interface to be enabled. Under normal circumstances, many XSS vulnerabilities might allow for broader exploitation or automated attacks; however, in this scenario, the attacker must craft a malicious GET link that includes the injected script payload within the if parameter and then lure a user with administrative privileges related to firewall rules into opening it via their web browser. Once the victim accesses this crafted URL while authenticated to the pfSense WebGUI, the embedded JavaScript executes within the security context of the administrator's session. This allows the attacker to perform actions on behalf of the privileged user without requiring additional authentication steps beyond what is already established by the active session.
From a threat modeling perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of this flaw being reflected rather than stored places it within the context of immediate exploitation requiring user interaction. In terms of adversarial tactics, this behavior maps to MITRE ATT&CK technique T1059.007, which covers JavaScript execution under client-side scripting. By leveraging the victim's existing administrative privileges, an attacker can potentially modify firewall rules to open ports, redirect traffic, or disable security controls entirely. This could lead to a complete compromise of the network perimeter protected by the pfSense appliance, allowing for further lateral movement within the internal network or exfiltration of sensitive data passing through the gateway.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary and most effective mitigation is to apply the vendor-provided software update that patches this specific vulnerability in firewall_rules.php by implementing proper output encoding for all dynamic content derived from user input, particularly the if parameter. Administrators should ensure their pfSense installations are updated to a version beyond 2.9.0 where these fixes have been integrated. In addition to patching, organizations should enforce strict access controls on the WebGUI interface, ensuring that only essential personnel have firewall rule modification privileges and that session timeouts are configured aggressively to limit the window of opportunity for exploitation if an attacker manages to trigger the script. Furthermore, implementing a Content Security Policy (CSP) header can help mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts can be loaded and executed within the browser environment. Regular security audits and penetration testing focused on web application inputs are also recommended to identify similar encoding flaws in other modules before they can be exploited.