Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Netgate — Vulnerabilities & Security Advisories 42

Browse all 42 CVE security advisories affecting Netgate. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Netgate develops network security solutions, primarily focusing on firewall and VPN technologies using pfSense and OPNsense platforms. Historically, vulnerabilities have included remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from improper input validation and authentication issues. The company has addressed security concerns through regular patches, though some incidents have exposed weaknesses in default configurations and administrative interfaces. Netgate's products remain widely deployed in enterprise environments, requiring careful hardening to mitigate risks associated with their 16 documented CVEs. Security researchers have noted that while vulnerabilities exist, prompt vendor response typically limits exploitation potential in properly maintained deployments.

CVE ID Title CVSS Severity Published
CVE-2026-111233 Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php — pfSense CE CWE-79 4.7 Medium 2026-10-15
CVE-2026-111232 Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color — pfSense CE CWE-79 4.8 Medium 2026-10-15
CVE-2026-111230 Netgate pfSense CE through 2.9.0 Local File Read via Dynamic DNS Update URL — pfSense CE CWE-73 4.9 Medium 2026-10-15
CVE-2026-111231 Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install() — pfSense CE CWE-863 7.2 High 2026-10-15
CVE-2026-111229 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via Captive Portal HA Sync — pfSense CE CWE-78 7.2 High 2026-10-15
CVE-2026-111228 Netgate pfSense CE 2.7.1 through 2.9.0 CRLF Injection via services_unbound_advanced.php — pfSense CE CWE-93 5.5 Medium 2026-10-15
CVE-2026-111227 Netgate pfSense CE through 2.9.0 CRLF Injection via services_unbound_acls.php — pfSense CE CWE-93 5.5 Medium 2026-10-15
CVE-2026-111226 Netgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.php — pfSense CE CWE-78 7.2 High 2026-10-15
CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh — pfSense CE CWE-78 5.0 Medium 2026-10-15
CVE-2026-111224 Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh — pfSense CE CWE-78 7.5 High 2026-10-15
CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 Command Injection via IPsec Mobile Login Banner — pfSense CE CWE-74 7.2 High 2026-10-15
CVE-2026-111222 Netgate pfSense CE through 2.9.0 php.ini Injection via Timezone Setting — pfSense CE CWE-93 6.6 Medium 2026-10-15
CVE-2026-111221 Netgate pfSense CE through 2.9.0 Command Injection via RADIUS Secret mpd.conf Injection — pfSense CE CWE-93 6.6 Medium 2026-10-15
CVE-2026-111220 Netgate pfSense CE through 2.9.0 Crontab Injection via PPP Periodic Reset ptpid — pfSense CE CWE-93 7.2 High 2026-10-15
CVE-2026-111219 Netgate pfSense CE through 2.9.0 Command Injection via PPPoE Server Username — pfSense CE CWE-93 6.6 Medium 2026-10-15
CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper Limiters — pfSense CE CWE-78 7.2 High 2026-10-15
CVE-2026-111216 Netgate pfSense CE through 2.9.0 OS Command Injection via Gateway Monitor IP — pfSense CE CWE-78 7.2 High 2026-10-15
CVE-2026-111217 Netgate pfSense CE through 2.9.0 OS Command Injection via CARP VHID — pfSense CE CWE-78 7.2 High 2026-10-15
CVE-2026-111215 Netgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent Interface — pfSense CE CWE-78 7.2 High 2026-10-15
CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.php — pfSense CE CWE-78 7.2 High 2026-10-15
CVE-2026-110908 pfSense FRR 2.0.2_1命令注入漏洞 — pfSense-pkg-frr CWE-78 8.8 High 2026-10-15
CVE-2026-97730 Netgate pfSense Plus/CE LFI漏洞导致任意PHP代码执行 — pfSense Plus CWE-24 8.5 High 2026-09-25
CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php — pfSense Plus CWE-79 5.4 Medium 2026-09-03
CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php — pfSense Plus CWE-79 5.4 Medium 2026-09-03
CVE-2026-56126 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php — pfSense Plus CWE-79 5.4 Medium 2026-09-03
CVE-2026-67189 pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record — pfSense Plus CWE-79 6.1 Medium 2026-08-19
CVE-2016-20057 NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege Escalation — NETGATE Registry Cleaner CWE-428 7.8 High 2026-04-04
CVE-2016-20058 Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege Escalation — NETGATE AMITI Antivirus CWE-428 7.8 High 2026-04-04
CVE-2019-25269 Amiti Antivirus 25.0.640 - Unquoted Service Path Vulnerability — Amiti Antivirus CWE-428 7.8 High 2026-02-04
CVE-2019-25271 NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path — Data Backup CWE-428 7.8 High 2026-02-04

This page lists every published CVE security advisory associated with Netgate. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.