CVE-2023-42326

What it actually does

CVE-2023-42326 is a command injection vulnerability in Netgate pfSense 2.7.0 affecting the interfaces_gif_edit.php and interfaces_gre_edit.php components used to configure GIF and GRE tunnel interfaces. A remote attacker with authenticated access can send a crafted request that causes attacker-controlled input to be interpreted as operating-system commands. Successful exploitation can result in arbitrary code execution on the firewall appliance with the privileges of the vulnerable web-management process, potentially allowing the attacker to read sensitive configuration, modify firewall behavior, create persistence, pivot through the network, or disrupt routing and security services.

Why it matters to the business

Because pfSense commonly sits at the network perimeter or at key internal routing boundaries, exploitation can have high operational impact. A compromised firewall can expose VPN settings, credentials, certificates, routing information, firewall rules, NAT policy, and traffic flows, and may allow an attacker to weaken network defenses or intercept, redirect, or block business traffic. The CVSS score is high at 8.8 and the EPSS probability is elevated at approximately 64%, indicating meaningful exploitation interest despite the vulnerability not being listed in CISA KEV. Organizations running pfSense 2.7.0 or pfSense Plus versions with the vulnerable components should treat externally reachable management interfaces and broadly accessible administrative portals as urgent remediation targets.

How an attack unfolds

An attacker first obtains valid pfSense administrative or otherwise sufficient authenticated access, because the vulnerability requires privileges. They then access the web configurator and submit a specially crafted HTTP request to interfaces_gif_edit.php or interfaces_gre_edit.php, targeting parameters used by GIF or GRE tunnel configuration. If input validation or command construction is unsafe, the injected payload is passed to the underlying operating system command interpreter. The attacker can then execute arbitrary commands on the appliance, confirm execution through command output, timing behavior, or side effects, and proceed to collect configuration data, add administrative users, alter firewall or VPN settings, deploy scripts, or establish persistence. If the management interface is exposed to the internet, exploitation can occur remotely after credential theft, password spraying, reuse of valid credentials, or compromise of an administrator session.

How to fix it

Upgrade affected Netgate pfSense and pfSense Plus installations to a vendor-supported release that contains the fix for the vulnerable interfaces_gif_edit.php and interfaces_gre_edit.php command handling. Netgate has not provided a fixed version in the supplied data, so administrators should consult the official Netgate security advisories and release notes and update to the latest stable pfSense CE or pfSense Plus version available for the appliance. If immediate upgrade is not possible, restrict access to the web configurator to a dedicated management network or VPN, block internet access to the administrative interface, enforce strong multifactor authentication where available, remove unnecessary administrator accounts, and audit GIF/GRE tunnel configuration changes. Disable or avoid creating GIF/GRE tunnel interfaces if they are not required until the system is patched. Back up configuration before upgrade, but protect backups as sensitive secrets because they may contain credentials and keys.

How to confirm the fix worked

Confirm the installed pfSense version is no longer 2.7.0 and matches a vendor-supported fixed or current release. Validate from the pfSense dashboard, console, or package/update manager, and compare against Netgate release notes. Confirm that the web configurator is not exposed to untrusted networks and is reachable only from approved management sources. Review firewall rules and NAT policy to ensure ports used for pfSense administration, commonly TCP/443 or any custom webConfigurator port, are not open from the internet unless strictly required through a hardened access path. Test that authenticated requests to interfaces_gif_edit.php and interfaces_gre_edit.php no longer allow shell metacharacters or command separators to influence system command execution. Review the current GIF and GRE interface configuration for unexpected entries, and verify no unauthorized administrator accounts, scheduled tasks, startup scripts, or firewall/VPN changes exist.

Typical attack path

1. Identify a pfSense 2.7.0 or vulnerable pfSense Plus management interface, especially one exposed over the network or internet.
2. Obtain valid credentials or an authenticated session through phishing, password reuse, brute force, credential theft, or prior compromise.
3. Send a crafted authenticated HTTP request to interfaces_gif_edit.php or interfaces_gre_edit.php with command-injection syntax in a tunnel-configuration parameter.
4. Execute a benign command to validate code execution, such as retrieving the current user, hostname, or writing a temporary file.
5. Run follow-on commands to read pfSense configuration, enumerate users, inspect VPN material, or modify firewall and routing rules.
6. Create persistence through new users, altered configuration, scheduled tasks, startup scripts, or web-accessible files where possible.
7. Use the firewall position to pivot, intercept traffic, disrupt connectivity, or weaken security controls.

How to detect it

Investigate whether exploitation already occurred by reviewing pfSense system logs, webConfigurator access logs, authentication logs, configuration history, and shell or command-execution artifacts around any access to interfaces_gif_edit.php or interfaces_gre_edit.php. Focus on authenticated POST requests to those endpoints, especially from unusual source IPs, outside normal administrative windows, or followed by configuration changes, service restarts, new users, package installation, or outbound network connections from the firewall. Search HTTP request logs and reverse-proxy/WAF logs for shell metacharacters and command separators in parameters submitted to the vulnerable endpoints, including semicolons, pipes, backticks, command substitution, URL-encoded newline characters, and common utility names. On the appliance, inspect /conf/config.xml for unexpected administrator accounts, GIF/GRE interface definitions, firewall/NAT/routing changes, VPN changes, and suspicious aliases. Review /var/log/system.log, /var/log/auth.log, /var/log/nginx/* if present, and any remote syslog/SIEM records for administrative logins, configuration saves, PHP errors, command execution anomalies, and service restarts. Look for persistence artifacts such as unexpected cron entries, modified startup scripts, unknown files in web directories, unusual binaries or scripts under /tmp or /var/tmp, and unexplained outbound connections to unfamiliar IP addresses. If threat hunting at the network layer, correlate pfSense management access with subsequent traffic from the firewall to external hosts, DNS lookups for paste or payload hosting services, or internal lateral movement attempts.

• interfaces_gif_edit.php
• interfaces_gre_edit.php
• POST /interfaces_gif_edit.php
• POST /interfaces_gre_edit.php
• GET /interfaces_gif_edit.php
• GET /interfaces_gre_edit.php
• %3b
• %7c
• %60
• %24%28
• %0a
• %0d
• ;id
• ; whoami
• ; uname
• |id
• | whoami
• `id`
• $(id)
• /conf/config.xml
• /var/log/system.log
• /var/log/auth.log
• /var/log/nginx
• /tmp/
• /var/tmp/
• /usr/local/www/
• /etc/crontab
• /var/cron/tabs/root
• config.xml changed
• webConfigurator
• php-fpm
• filter_configure
• rc.update_urltables
• pkg install
• fetch http
• fetch https
• curl http
• curl https
• nc -e
• /bin/sh
• /bin/csh

What your security team should do

• Prioritize patching or upgrading any pfSense 2.7.0 systems, especially internet-facing or shared-management deployments, because the vulnerability enables authenticated remote code execution and has elevated EPSS exploitation probability.
• Immediately restrict pfSense web configurator access to trusted administrative networks or VPN-only access; remove any direct exposure from the public internet.
• Audit administrative accounts, recent logins, configuration changes, and GIF/GRE interface modifications for signs of unauthorized activity.
• Rotate passwords, API keys, VPN shared secrets, and certificates if compromise is suspected, because firewall configuration backups and runtime files may expose sensitive material.
• Enable or strengthen multifactor authentication and least-privilege administrative access where supported.
• Collect and preserve pfSense system logs, webConfigurator logs, shell history, and configuration backups before major cleanup if incident response is required.
• Review firewall, NAT, VPN, routing, and DNS forwarding settings for attacker-introduced changes that could enable persistence, interception, or bypass.
• Monitor for suspicious outbound connections from the firewall appliance, unexpected package installations, new files in web-accessible directories, and unusual cron or startup entries.