Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

pfSense CE — Vulnerabilities & Security Advisories 27

All 27 CVE vulnerabilities found in pfSense CE, with AI-generated Chinese analysis, references, and POCs.

Vendor: Netgate

CVE ID Title CVSS Severity Published
CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php CWE-79 4.7 Medium 2026-10-15
CVE-2026-111232 Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color CWE-79 4.8 Medium 2026-10-15
CVE-2026-111231 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() CWE-863 7.2 High 2026-10-15
CVE-2026-111230 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL CWE-73 4.9 Medium 2026-10-15
CVE-2026-111229 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync CWE-78 7.2 High 2026-10-15
CVE-2026-111228 Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php CWE-93 5.5 Medium 2026-10-15
CVE-2026-111227 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php CWE-93 5.5 Medium 2026-10-15
CVE-2026-111226 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php CWE-78 7.2 High 2026-10-15
CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh CWE-78 5.0 Medium 2026-10-15
CVE-2026-111224 Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh CWE-78 7.5 High 2026-10-15
CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner CWE-74 7.2 High 2026-10-15
CVE-2026-111222 Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting CWE-93 6.6 Medium 2026-10-15
CVE-2026-111221 Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection CWE-93 6.6 Medium 2026-10-15
CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username CWE-93 6.6 Medium 2026-10-15
CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid CWE-93 7.2 High 2026-10-15
CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters CWE-78 7.2 High 2026-10-15
CVE-2026-111216 Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP CWE-78 7.2 High 2026-10-15
CVE-2026-111217 Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID CWE-78 7.2 High 2026-10-15
CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface CWE-78 7.2 High 2026-10-15
CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php CWE-78 7.2 High 2026-10-15
CVE-2025-34178 Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting CWE-79 5.4AI Medium AI 2025-09-09
CVE-2025-34177 Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting CWE-79 5.4AI Medium AI 2025-09-09
CVE-2025-34176 Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure CWE-22 4.3AI Medium AI 2025-09-09
CVE-2025-34175 Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting CWE-79 6.1AI Medium AI 2025-09-09
CVE-2025-34174 Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting CWE-79 5.4AI Medium AI 2025-09-09
CVE-2025-34173 Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure CWE-22 4.3AI Medium AI 2025-09-09
CVE-2025-34172 Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting CWE-79 6.1AI Medium AI 2025-09-09

All 27 known CVE vulnerabilities affecting pfSense CE with full Chinese analysis, references, and POCs where available.