CVE-2024-46538

What it actually does

CVE-2024-46538 is a cross-site scripting vulnerability in pfSense 2.5.2 affecting interfaces_groups_edit.php. A crafted value that reaches the $pconfig handling path can be rendered back into the administrative web interface without sufficient output encoding or sanitization, allowing attacker-controlled JavaScript or HTML to execute in the browser of a user who views the affected page. Successful exploitation can let the attacker act within the victim administrator’s browser session, potentially reading page content, modifying firewall configuration through authenticated requests, or performing other actions available to that user in the pfSense web UI.

Why it matters to the business

If exploited, this vulnerability can compromise trust in the firewall administration interface and may allow unauthorized configuration changes through an administrator’s active session. Because pfSense often controls network routing, firewall policy, VPN access, and perimeter security, even a browser-based flaw can have operational impact if it is used to alter rules, create access paths, weaken segmentation, or disrupt connectivity. The CVSS score is moderate, but the EPSS score is high, indicating elevated likelihood of exploitation activity compared with many vulnerabilities; organizations still running pfSense 2.5.2 should treat remediation as time-sensitive even though it is not currently listed in CISA KEV and is not known to be associated with ransomware campaigns.

How an attack unfolds

An attacker first needs a way to deliver or store a crafted payload that is processed by the vulnerable interfaces_groups_edit.php workflow. The payload contains JavaScript or HTML intended to survive server-side handling and be rendered in the pfSense administrative interface. When an administrator or another privileged user opens the affected interface group editing page, the browser interprets the injected content as active script rather than inert data. The script then executes in the security context of the pfSense web UI. From there, the attacker may attempt to issue same-origin requests using the victim’s authenticated session, collect page-visible data, change interface group settings, alter firewall-related configuration, or stage further administrative actions. Practical exploitation depends on authentication requirements, CSRF protections, administrative workflow, and whether the attacker can cause a privileged user to view the malicious state.

How to fix it

Upgrade pfSense from version 2.5.2 to a current supported release that includes security fixes. No exact fixed version was provided in the input, so use the latest vendor-supported pfSense CE or pfSense Plus release available for the deployment and review Netgate/pfSense release notes for the applicable XSS fix. If immediate upgrade is not possible, restrict access to the pfSense webConfigurator to a dedicated management network or VPN, block Internet exposure of the administrative UI, require MFA where available, limit administrator accounts, disable or remove unnecessary lower-privileged accounts, and avoid allowing untrusted users to create or modify interface group configuration. Clear suspicious interface group names, descriptions, or related configuration values containing HTML, JavaScript, event handlers, encoded script tags, or unusual markup.

How to confirm the fix worked

Confirm the installed pfSense version is no longer 2.5.2 and is on a supported, patched release. Verify the administrative web interface is not exposed to the public Internet and is reachable only from approved management sources. Review interface group configuration values for literal or encoded HTML/JavaScript payloads. In a controlled test environment only, attempt to save benign HTML-like input in the interface group edit workflow and confirm it is rejected, safely encoded, or displayed as text rather than executed. Validate that web server logs no longer show suspicious requests to interfaces_groups_edit.php containing script tags, event handlers, javascript: URIs, or encoded equivalents.

Typical attack path

1. Identify an exposed or reachable pfSense 2.5.2 administrative web interface.
2. Gain access to a workflow, account, or input path that can influence interface group configuration handled by interfaces_groups_edit.php.
3. Submit a crafted HTML or JavaScript payload that reaches the vulnerable $pconfig rendering path.
4. Wait for, lure, or cause a privileged pfSense user to open the affected interface group edit page.
5. Execute attacker-controlled script in the administrator’s browser session.
6. Use the active administrative session to read sensitive page data, submit configuration changes, or perform additional authenticated actions.
7. Optionally attempt to persist access by weakening firewall policy, changing VPN or interface settings, or creating paths for later access.

How to detect it

Review pfSense webConfigurator access logs, system logs, configuration change history, and administrator session activity for suspicious interactions with interfaces_groups_edit.php. Look for requests containing literal or URL-encoded script tags, HTML event handlers, javascript: URIs, iframe/object/embed tags, or unusual markup in parameters associated with interface groups. Examine /cf/conf/config.xml and configuration backups for malicious values in interface group-related entries, especially strings containing script, encoded script, event-handler attributes, or external URLs. Correlate any suspicious requests with administrator logins, configuration writes, firewall rule changes, NAT changes, VPN changes, interface group modifications, and unexpected session activity. If threat hunting after possible exploitation, review browser history and cached content on administrator workstations that accessed the pfSense UI, and inspect whether any unauthorized configuration changes occurred shortly after the affected page was viewed.

• interfaces_groups_edit.php
• GET /interfaces_groups_edit.php
• POST /interfaces_groups_edit.php
• %3Cscript
• <script
• %3C%2Fscript%3E
• </script>
• javascript:
• onerror=
• onload=
• onclick=
• onmouseover=
• %3Ciframe
• <iframe
• %3Cimg
• <img
• %3Csvg
• <svg
• /cf/conf/config.xml
• interfaces_groups_edit.php.*%3Cscript
• interfaces_groups_edit.php.*<script
• interfaces_groups_edit.php.*javascript:
• interfaces_groups_edit.php.*onerror=
• interfaces_groups_edit.php.*onload=

What your security team should do

• Prioritize upgrade of pfSense 2.5.2 systems to a current supported release because the EPSS score is high despite the moderate CVSS rating.
• Immediately remove public Internet access to the pfSense administrative interface if present; allow access only from trusted management networks or VPN.
• Review pfSense interface group configuration for suspicious script, HTML, or encoded payloads and remove any untrusted content.
• Audit administrator activity around the time suspicious interface group changes or requests to interfaces_groups_edit.php occurred.
• Rotate administrative credentials and invalidate active sessions if exploitation is suspected.
• Monitor firewall, NAT, interface, VPN, and user-management configuration changes for unauthorized modifications.
• Create SIEM detections for suspicious requests to interfaces_groups_edit.php containing XSS payload patterns.
• Treat any confirmed execution as a potential administrative-session compromise and perform configuration integrity review of the firewall.