CVE-2026-111233

Awaiting Analysis Awaiting Analysis - Queue

Reflected XSS in Netgate pfSense WebGUI

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-111233

EUVD

EUVD-2026-102345

Affected Vendors & Products

Vendor	Product	Version / Range
Netgate	pfSense	CE 2.7.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-111233 is a reflected cross-site scripting (XSS) vulnerability in Netgate pfSense CE versions 2.7.1 through 2.9.0. It exists in the firewall_rules.php page where the 'if' parameter is not properly sanitized, allowing attackers to inject malicious JavaScript code via a crafted GET link. This requires the non-default 'Require Firewall Interface' option to be enabled and targets users with firewall rules privileges.

Detection Guidance

To detect this vulnerability, inspect firewall_rules.php for improper input handling in the 'if' parameter. Check if the 'Require Firewall Interface' option is enabled in pfSense settings. Review web server logs for suspicious GET requests containing the 'if' parameter with script payloads.

Impact Analysis

This vulnerability allows attackers to execute arbitrary scripts in the victim's browser session within the pfSense WebGUI. This could lead to session hijacking, theft of sensitive data like session cookies, or manipulation of displayed firewall rules. However, it does not directly impact system availability.

Compliance Impact

This reflected XSS vulnerability could potentially impact compliance with GDPR and HIPAA by enabling attackers to steal session cookies or manipulate displayed data, which may lead to unauthorized access to sensitive information. However, the actual impact depends on whether the affected system processes or stores regulated data.

Mitigation Strategies

Apply the vendor patch if available. Temporarily disable the 'Require Firewall Interface' option in pfSense settings. Implement input validation by sanitizing the 'if' parameter using htmlspecialchars() with ENT_QUOTES. Restrict access to the firewall_rules.php page to trusted users only.

Hi! I’m here to help you understand CVE-2026-111233. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70