CVE-2026-111233lowCWE-79

CVE-2026-111233: fallo de gravedad baja en Netgate pfSense CE

Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php

Publicada el

Seguir esta CVE+ Monitorear pfSense CE

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 2.3epss 1.1%
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Productos afectados
Netgate · pfSense CE
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Netgate pfSense CE

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 21.3%CVE-2025-34176MEDIUMNetgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information DisclosureEPSS 17.3%CVE-2025-34174MEDIUMNetgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site ScriptingEPSS 14.5%CVE-2026-111214HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.phpEPSS 10.8%CVE-2026-111218HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper LimitersEPSS 8.6%CVE-2026-111217HIGHNetgate pfSense CE through 2.9.0 OS Command Injection via CARP VHIDEPSS 7.0%