pfSense 2.9.0 Security Advisories: Fixes for XSS, DoS, and Brute Force Bypass

Vulnerability Overview The webpage screenshot mainly introduces the new features and changes in pfSense version 2.9.0, which include several security fixes and vulnerability patches. The following is a summary of the key information regarding the vulnerabilities: Impact Scope pfSense-SA-25_09.osguard: Brute-force protection bypass and potential denial-of-service vulnerability. pfSense-SA-26_01.webgui: The function fails to correctly validate or escape the PID file parameter. pfSense-SA-26_02.webgui: Potential reflected XSS vulnerability in the Delegated Length value for prefix delegation when using Kea in . pfSense-SA-26_03.webgui: Potential stored XSS vulnerability when using ISC DHCP in . pfSense-SA-26_04.webgui: Potential XSS vulnerability in the post titles of RSS Widget feed content. pfSense-SA-26_05.webgui: Potential XSS vulnerability in the Captive Portal widget. Remediation pfSense-SA-25_09.osguard: Resolved the brute-force protection bypass and potential denial-of-service vulnerability. pfSense-SA-26_01.webgui: Fixed the issue where the function did not correctly validate or escape the PID file parameter. pfSense-SA-26_02.webgui: Fixed the potential XSS vulnerability in the Delegated Length value for prefix delegation when using Kea in . pfSense-SA-26_03.webgui: Fixed the potential stored XSS vulnerability when using ISC DHCP in . pfSense-SA-26_04.webgui: Fixed the potential XSS vulnerability in the post titles of RSS Widget feed content. pfSense-SA-26_05.webgui: Fixed the potential XSS vulnerability in the Captive Portal widget. POC Code or Exploit Code No specific POC code or exploit code is provided in the document. Summary The pfSense 2.9.0 release contains multiple security patches, primarily addressing brute-force protection mechanisms and XSS vulnerabilities. Users are advised to upgrade to this version as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

pfSense 2.9.0 Security Advisories: Fixes for XSS, DoS, and Brute Force Bypass