Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

pfSense CE — Vulnerabilities & Security Advisories 27

All 27 CVE vulnerabilities found in pfSense CE, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses and vulnerability reports specifically for the pfSense CE firewall distribution developed by Netgate. The collection encompasses a wide spectrum of flaws including remote code execution, privilege escalation, denial of service, and information disclosure issues identified across the product's release history from its inception to the current stable version. Visitors can utilize this resource to track official vendor advisories, analyze the prevalence and impact of specific weakness classes within embedded network appliances, or review the complete historical vulnerability record for pfSense CE to support security assessments and remediation planning. The data is curated from public databases and vendor announcements to provide a comprehensive view of the product's security posture without including unverified or speculative entries. This centralized repository enables security professionals, system administrators, and researchers to efficiently correlate multiple reports and understand the evolution of threats targeting this widely deployed open-source firewall solution. By presenting aggregated findings in a structured format, the page facilitates faster identification of affected components and helps organizations prioritize patching efforts based on the severity and exploitability of the disclosed issues.

Vendor: Netgate

CVE ID Title CVSS Severity Published
CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php CWE-79 4.7 Medium 2026-10-15
CVE-2026-111232 Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color CWE-79 4.8 Medium 2026-10-15
CVE-2026-111231 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() CWE-863 7.2 High 2026-10-15
CVE-2026-111230 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL CWE-73 4.9 Medium 2026-10-15
CVE-2026-111229 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync CWE-78 7.2 High 2026-10-15
CVE-2026-111228 Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php CWE-93 5.5 Medium 2026-10-15
CVE-2026-111227 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php CWE-93 5.5 Medium 2026-10-15
CVE-2026-111226 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php CWE-78 7.2 High 2026-10-15
CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh CWE-78 5.0 Medium 2026-10-15
CVE-2026-111224 Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh CWE-78 7.5 High 2026-10-15
CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner CWE-74 7.2 High 2026-10-15
CVE-2026-111222 Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting CWE-93 6.6 Medium 2026-10-15
CVE-2026-111221 Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection CWE-93 6.6 Medium 2026-10-15
CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username CWE-93 6.6 Medium 2026-10-15
CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid CWE-93 7.2 High 2026-10-15
CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters CWE-78 7.2 High 2026-10-15
CVE-2026-111216 Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP CWE-78 7.2 High 2026-10-15
CVE-2026-111217 Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID CWE-78 7.2 High 2026-10-15
CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface CWE-78 7.2 High 2026-10-15
CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php CWE-78 7.2 High 2026-10-15
CVE-2025-34178 Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting CWE-79 5.4AI Medium AI 2025-09-09
CVE-2025-34177 Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting CWE-79 5.4AI Medium AI 2025-09-09
CVE-2025-34176 Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure CWE-22 4.3AI Medium AI 2025-09-09
CVE-2025-34175 Netgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site Scripting CWE-79 6.1AI Medium AI 2025-09-09
CVE-2025-34174 Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting CWE-79 5.4AI Medium AI 2025-09-09
CVE-2025-34173 Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure CWE-22 4.3AI Medium AI 2025-09-09
CVE-2025-34172 Netgate pfSense CE HAProxy Package 0.63_10 Reflected Cross-Site Scripting CWE-79 6.1AI Medium AI 2025-09-09

All 27 known CVE vulnerabilities affecting pfSense CE with full Chinese analysis, references, and POCs where available.