CVE-2026-111233 Overview
CVE-2026-111233 is a reflected cross-site scripting (XSS) vulnerability in Netgate pfSense Community Edition (CE) versions 2.7.1 through 2.9.0. The flaw resides in firewall_rules.php, which fails to properly encode the if parameter before reflecting it into the WebGUI response. Exploitation requires the non-default Require Firewall Interface option to be enabled. An attacker can craft a malicious GET link and lure an authenticated user with firewall rules privileges into opening it, triggering script execution in the WebGUI with that user's privileges. The weakness is tracked as [CWE-79].
Critical Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the authenticated user's browser session, enabling WebGUI actions on their behalf, including firewall rule modification.
Affected Products
- Netgate pfSense CE 2.7.1
- Netgate pfSense CE releases through 2.9.0
- firewall_rules.php component in the pfSense WebGUI
Discovery Timeline
- 2026-10-15 - CVE-2026-111233 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-111233
Vulnerability Analysis
The vulnerability is a reflected XSS in the pfSense WebGUI page that renders firewall rules. The if query parameter is reflected into the HTML response without sufficient output encoding. When the Require Firewall Interface option is enabled, the parameter path becomes reachable through a crafted request. An authenticated user with firewall rules privileges who clicks a malicious link causes attacker-controlled script to run inside the WebGUI origin. Because the script executes under the victim's authenticated session, it can issue authorized WebGUI requests, including firewall configuration changes available to that user. The attack is client-side, requires user interaction, and depends on a non-default configuration, which constrains real-world exploitability. The EPSS probability is 1.064%.
Root Cause
The root cause is improper neutralization of input during web page generation in firewall_rules.php. The if parameter supplied via GET is echoed into HTML output without context-appropriate escaping, allowing script-breaking characters to escape the intended markup context. See the vendor source references for the exact lines in firewall_rules.php lines 138-146 and line 391.
Attack Vector
The attack vector is network-based with required user interaction. An unauthenticated attacker crafts a URL to the pfSense WebGUI containing a malicious payload in the if parameter. The attacker delivers the link through phishing, chat, or an embedded reference. When a logged-in administrator or operator with firewall rules privileges follows the link on a pfSense instance configured with Require Firewall Interface enabled, the injected script executes in the WebGUI context. Technical details are documented in the Abraxas Labs Research Report, the VulnCheck Advisory, and the GitHub pfsense XSS Rules proof-of-concept repository.
Detection Methods for CVE-2026-111233
Indicators of Compromise
- Web server or proxy logs showing GET requests to firewall_rules.php containing HTML control characters, <script> tags, or javascript: sequences in the if parameter.
- Unexpected firewall rule changes correlated in time with WebGUI access from an administrator session.
- Referer headers pointing to external or untrusted domains on requests to firewall_rules.php.
Detection Strategies
- Inspect pfSense access logs for anomalous values in the if parameter, especially encoded payloads such as %3Cscript%3E or onerror=.
- Deploy a web application firewall rule to flag reflected content patterns on /firewall_rules.php requests.
- Correlate WebGUI configuration change events with the source IP and session of recently accessed URLs containing suspicious query strings.
Monitoring Recommendations
- Enable verbose WebGUI access logging on pfSense and forward logs to a centralized SIEM.
- Alert on requests to firewall_rules.php originating from off-network client IPs or unusual user agents.
- Monitor administrator browser sessions for unexpected navigation events to the pfSense management interface.
How to Mitigate CVE-2026-111233
Immediate Actions Required
- Verify whether the Require Firewall Interface option is enabled; if it is not required for your environment, disable it to remove the exploitation precondition.
- Restrict WebGUI access to a dedicated management network or VPN, and block external access to the pfSense management interface.
- Enforce least privilege for WebGUI users to limit the impact of a compromised session.
Patch Information
No vendor advisory URL is referenced in the NVD record at publication. Administrators should monitor Netgate release notes for a fixed version beyond pfSense CE 2.9.0 and apply updates once available. Review the VulnCheck Advisory for current remediation guidance.
Workarounds
- Disable the Require Firewall Interface option if operationally feasible, since the vulnerable path depends on this non-default setting.
- Train administrators to avoid clicking unsolicited links that reference the pfSense WebGUI, and to access firewall_rules.php only through bookmarks.
- Use browser isolation or a dedicated management workstation for pfSense administration to contain reflected XSS payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
