Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    9 vulnerabilities found for pfSense Plus by Netgate

    CVE-2026-67189 (GCVE-0-2026-67189)

    Vulnerability from nvd – Published: 2026-08-19 19:18 – Updated: 2026-08-19 19:18
    VLAI
    Title
    pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record
    Summary
    pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Netgate pfSense Plus Affected: 0 , < 26.07 (custom)
    		Create a notification for this product.
    Netgate pfSense CE Affected: 0 , ≤ 2.8.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-08-13 00:00
    Credits
    BENDIB MOHAMED ANIS VulnCheck
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "pfSense Plus",
          "vendor": "Netgate",
          "versions": [
            {
              "lessThan": "26.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "pfSense CE",
          "vendor": "Netgate",
          "versions": [
            {
              "lessThanOrEqual": "2.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "BENDIB MOHAMED ANIS"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator\u0027s browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T19:18:50.158Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Vendor Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.netgate.com/downloads/pfSense-SA-26_21.webgui.asc"
        },
        {
          "name": "Plus Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.netgate.com/pfsense/en/latest/releases/26-07.html"
        },
        {
          "name": "CE Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pfsense-plus-ce-stored-xss-via-traffic-graphs-ptr-record"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67189",
    "datePublished": "2026-08-19T19:18:50.158Z",
    "dateReserved": "2026-07-28T16:06:49.773Z",
    "dateUpdated": "2026-08-19T19:18:50.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-67189 (GCVE-0-2026-67189)

    Vulnerability from cvelistv5 – Published: 2026-08-19 19:18 – Updated: 2026-08-19 19:18
    VLAI
    Title
    pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record
    Summary
    pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
    6.1 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    Netgate pfSense Plus Affected: 0 , < 26.07 (custom)
    		Create a notification for this product.
    Netgate pfSense CE Affected: 0 , ≤ 2.8.1 (semver)
    		Create a notification for this product.
    Date Public
    2026-08-13 00:00
    Credits
    BENDIB MOHAMED ANIS VulnCheck
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "pfSense Plus",
          "vendor": "Netgate",
          "versions": [
            {
              "lessThan": "26.07",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "pfSense CE",
          "vendor": "Netgate",
          "versions": [
            {
              "lessThanOrEqual": "2.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "BENDIB MOHAMED ANIS"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulnCheck"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator\u0027s browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T19:18:50.158Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Vendor Advisory",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://docs.netgate.com/downloads/pfSense-SA-26_21.webgui.asc"
        },
        {
          "name": "Plus Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.netgate.com/pfsense/en/latest/releases/26-07.html"
        },
        {
          "name": "CE Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/pfsense-plus-ce-stored-xss-via-traffic-graphs-ptr-record"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "pfSense Plus/CE Stored XSS via Traffic Graphs PTR Record",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-67189",
    "datePublished": "2026-08-19T19:18:50.158Z",
    "dateReserved": "2026-07-28T16:06:49.773Z",
    "dateUpdated": "2026-08-19T19:18:50.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CERTFR-2026-AVI-1022

    Vulnerability from certfr_avis - Published: 2026-08-14 - Updated: 2026-08-14

    De multiples vulnérabilités ont été découvertes dans les produits Netgate. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Netgate pfSense Plus pfSense Plus versions antérieures à 26.07
    Netgate pfSense CE pfSense CE versions antérieures à 2.9.0
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "pfSense Plus versions ant\u00e9rieures \u00e0 26.07",
      "product": {
        "name": "pfSense Plus",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense CE versions ant\u00e9rieures \u00e0 2.9.0",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-56127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56127"
    },
    {
      "name": "CVE-2026-67189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67189"
    },
    {
      "name": "CVE-2026-56126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56126"
    },
    {
      "name": "CVE-2026-56128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56128"
    }
  ],
  "initial_release_date": "2026-08-14T00:00:00",
  "last_revision_date": "2026-08-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1022",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Netgate. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Netgate",
  "vendor_advisories": [
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_13",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_13.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_12",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_12.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_19",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_19.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_20",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_20.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_11",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_11.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_15",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_15.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_10",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_10.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_14",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_14.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_07",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_07.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_09",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_09.packages.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_08",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_08.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_06",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_06.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_16",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_16.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_18",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_18.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_21",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_21.webgui.asc"
    },
    {
      "published_at": "2026-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_17",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_17.webgui.asc"
    }
  ]
}

    CERTFR-2026-AVI-0516

    Vulnerability from certfr_avis - Published: 2026-04-30 - Updated: 2026-04-30

    Une vulnérabilité a été découverte dans les produits Netgate. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Netgate pfSense CE pfSense CE versions antérieures ou égales à 2.8.1 sans le dernier correctif de sécurité
    Netgate pfSense Plus pfSense Plus versions antérieures ou égales à 26.03 sans le dernier correctif de sécurité
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": " pfSense CE versions ant\u00e9rieures ou \u00e9gales \u00e0 2.8.1 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense Plus versions ant\u00e9rieures ou \u00e9gales \u00e0 26.03 sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "pfSense Plus",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2026-04-30T00:00:00",
  "last_revision_date": "2026-04-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0516",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-04-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Netgate. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Netgate",
  "vendor_advisories": [
    {
      "published_at": "2026-04-29",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_05",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_05.webgui.asc"
    }
  ]
}

    CERTFR-2026-AVI-0387

    Vulnerability from certfr_avis - Published: 2026-04-02 - Updated: 2026-04-02

    De multiples vulnérabilités ont été découvertes dans les produits Netgate. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une injection de code indirecte à distance (XSS).

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Netgate pfSense Plus pfSense Plus versions antérieures à 26.07
    Netgate pfSense CE pfSense CE version 2.8.1 sans les derniers correctifs de sécurité
    Netgate pfSense CE pfSense CE versions antérieures à 2.8.1
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "pfSense Plus versions ant\u00e9rieures \u00e0 26.07",
      "product": {
        "name": "pfSense Plus",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense CE version 2.8.1 sans les derniers correctifs de s\u00e9curit\u00e9",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense CE versions ant\u00e9rieures \u00e0 2.8.1",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2026-04-02T00:00:00",
  "last_revision_date": "2026-04-02T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0387",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-04-02T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Netgate. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Netgate",
  "vendor_advisories": [
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_04",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_04.webgui.asc"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_03",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_03.webgui.asc"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_01",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_01.webgui.asc"
    },
    {
      "published_at": "2026-04-01",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-26_02",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-26_02.webgui.asc"
    }
  ]
}

    CERTFR-2025-AVI-1101

    Vulnerability from certfr_avis - Published: 2025-12-12 - Updated: 2025-12-12

    De multiples vulnérabilités ont été découvertes dans les produits Netgate. Elles permettent à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    L'éditeur conseille d'appliquer les mesures de contournements en attendant la mise à disponibilité de pfSense CE 2.8.1.

    Impacted products
    Vendor Product Description
    Netgate pfSense Plus pfSense Plus versions antérieures à 25.11
    Netgate pfSense CE pfSense CE versions antérieures à 2.8.1
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "pfSense Plus versions ant\u00e9rieures \u00e0 25.11",
      "product": {
        "name": "pfSense Plus",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense CE versions ant\u00e9rieures \u00e0 2.8.1 ",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur conseille d\u0027appliquer les mesures de contournements en attendant la mise \u00e0 disponibilit\u00e9 de pfSense CE 2.8.1.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2025-12-12T00:00:00",
  "last_revision_date": "2025-12-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-1101",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-12-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Netgate. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Netgate",
  "vendor_advisories": [
    {
      "published_at": "2025-12-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_09",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_09.sshguard.asc"
    }
  ]
}

    CERTFR-2025-AVI-0654

    Vulnerability from certfr_avis - Published: - Updated:

    De multiples vulnérabilités ont été découvertes dans les produits Netgate. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS).

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Netgate pfSense Plus pfSense Plus versions antérieures à 25.07
    Netgate pfSense CE pfSense CE versions antérieures à 2.8.1
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "pfSense Plus versions ant\u00e9rieures \u00e0 25.07",
      "product": {
        "name": "pfSense Plus",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense CE versions ant\u00e9rieures \u00e0 2.8.1",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2025-AVI-0654",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Netgate. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Netgate",
  "vendor_advisories": [
    {
      "published_at": "2025-08-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_08",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_08.webgui.asc"
    }
  ]
}

    CERTFR-2025-AVI-0423

    Vulnerability from certfr_avis - Published: - Updated:

    De multiples vulnérabilités ont été découvertes dans les produits Netgate. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Netgate pfSense Plus pfSense Plus versions antérieures à 25.07
    Netgate pfSense CE pfSense CE versions antérieures à 2.9.0
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "pfSense Plus versions ant\u00e9rieures \u00e0 25.07",
      "product": {
        "name": "pfSense Plus",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense CE versions ant\u00e9rieures \u00e0 2.9.0",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-57273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-57273"
    },
    {
      "name": "CVE-2024-54779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-54779"
    },
    {
      "name": "CVE-2024-54780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-54780"
    }
  ],
  "links": [],
  "reference": "CERTFR-2025-AVI-0423",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-05-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Netgate. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Netgate",
  "vendor_advisories": [
    {
      "published_at": "2025-05-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_03",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_03.webgui.asc"
    },
    {
      "published_at": "2025-05-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_05",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_05.webgui.asc"
    },
    {
      "published_at": "2025-05-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_06",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_06.webgui.asc"
    },
    {
      "published_at": "2025-05-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_04",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_04.webgui.asc"
    },
    {
      "published_at": "2025-05-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_02",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_02.webgui.asc"
    },
    {
      "published_at": "2025-05-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_01",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_01.webgui.asc"
    },
    {
      "published_at": "2025-05-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-25_07",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-25_07.webgui.asc"
    }
  ]
}

    CERTFR-2024-AVI-1019

    Vulnerability from certfr_avis - Published: - Updated:

    De multiples vulnérabilités ont été découvertes dans Netgate pfSense. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Netgate pfSense CE pfSense CE versions antérieures à 2.8.0
    Netgate pfSense Plus pfSense Plus versions antérieures à 24.11
    References

    Show details on source website
    To clipboard 

    {
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "pfSense CE versions ant\u00e9rieures \u00e0 2.8.0",
      "product": {
        "name": "pfSense CE",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    },
    {
      "description": "pfSense Plus versions ant\u00e9rieures \u00e0 24.11",
      "product": {
        "name": "pfSense Plus",
        "vendor": {
          "name": "Netgate",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "links": [],
  "reference": "CERTFR-2024-AVI-1019",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-11-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Netgate pfSense. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Netgate pfSense",
  "vendor_advisories": [
    {
      "published_at": "2024-11-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-24_05",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-24_05.webgui.asc"
    },
    {
      "published_at": "2024-11-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-24_07",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-24_07.dhclient.asc"
    },
    {
      "published_at": "2024-11-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-24_08",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-24_08.webgui.asc"
    },
    {
      "published_at": "2024-11-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Netgate pfSense-SA-24_06",
      "url": "https://docs.netgate.com/downloads/pfSense-SA-24_06.sshguard.asc"
    }
  ]
}