Netgate Secure networking solutions

By the Year

In 2026 there have been 34 vulnerabilities in Netgate with an average score of 7.0 out of ten. Last year, in 2025 Netgate had 12 security vulnerabilities published. That is, 22 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.58.

Recent Netgate Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-111233	Oct 15, 2026	pfSense CE 2.7.1-2.9.0 Reflected XSS in firewall_rules.php Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.	Pfsense
CVE-2026-111232	Oct 15, 2026	Netgate pfSense CE 2.3.0-2.9.0 Stored XSS via separator color Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.	Pfsense
CVE-2026-111230	Oct 15, 2026	pfSense CE <=2.9.0 LFR via DDNS client (services_dyndns_edit.php) Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.	Pfsense
CVE-2026-111231	Oct 15, 2026	CVE-2026-111231	Pfsense
CVE-2026-111229	Oct 15, 2026	CVE-2026-111229	Pfsense
CVE-2026-111228	Oct 15, 2026	pfSense CE 2.7.1-2.9.0 Unbound CRLF Injection via services_unbound_advanced.php Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.	Pfsense
CVE-2026-111227	Oct 15, 2026	pfSense CE 2.9.0 Unbound ACL CRLF Injection Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.	Pfsense
CVE-2026-111226	Oct 15, 2026	pfSense CE 2.4.52.9.0 OS command injection in sshguard config pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.	Pfsense
CVE-2026-111225	Oct 15, 2026	pfSense CE 2.5.0-2.9.0 OS Command Injection in openvpn.learn-address.sh Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.	Pfsense
CVE-2026-111223	Oct 15, 2026	Netgate pfSense CE 2.7.0-2.9.0 Config Injection (login_banner) Root Exec Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.	Pfsense
CVE-2026-111224	Oct 15, 2026	pfSense CE <=2.9.0 OpenVPN openvpn.connect_async.sh OS command injection pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.	Pfsense
CVE-2026-111222	Oct 15, 2026	pfSense CE <=2.9.0 php.ini injection via timezone (auto_prepend_file) Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.	Pfsense
CVE-2026-111221	Oct 15, 2026	CVE-2026-111221	Pfsense
CVE-2026-111220	Oct 15, 2026	pfSense CE <2.9.0 Crontab Injection via interfaces_ppps_edit.php pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.	Pfsense
CVE-2026-111219	Oct 15, 2026	pfSense CE 2.9.0 Newline Injection in services_pppoe_edit.php (MPD5) Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.	Pfsense
CVE-2026-111218	Oct 15, 2026	Netgate pfSense CE 2.7.0-2.9.0 OS Command Injection in Traffic Shaper Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.	Pfsense
CVE-2026-111217	Oct 15, 2026	pfSense CE 2.9.0 OS command injection (CARP VHID) Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as root by storing an unvalidated CARP VHID. Attackers can supply a VHID containing shell metacharacters that executes via interface_ipalias_configure() ifconfig calls or get_carp_interface_status() when CARP status is rendered.	Pfsense
CVE-2026-111216	Oct 15, 2026	pfSense CE 2.9.0 dpinger OS Command Injection via IPv6 Zone Index Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as root by injecting shell metacharacters into an IPv6 link-local zone index. Attackers can set a gateway Monitor IP whose unvalidated zone carries a payload, which start_dpinger() passes unescaped to the dpinger shell command when monitoring is applied.	Pfsense
CVE-2026-111215	Oct 15, 2026	pfSense CE 2.9.0 OS Cmd Injection via Wireless Interface Name Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.	Pfsense
CVE-2026-111214	Oct 15, 2026	pfSense CE 2.7.0-2.9.0 OS Command Injection via QinQ Interface Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root.	Pfsense
CVE-2026-97730	Sep 25, 2026	pfSense LFI via Dashboard widget sequence before 26.07/2.9.0 In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard settings and write arbitrary files to the pfSense firewall system (e.g., /tmp/test.widget.php) can submit a crafted widget sequence value containing a path traversal payload (e.g., ../../../../../../../../../../../tmp/test). The Dashboard will subsequently read and execute the arbitrary PHP file as if it were a standard widget.	Pfsense Plus Pfsense Ce
CVE-2026-78902	Sep 25, 2026	Cross Site Scripting in Netgate pfSense 26.03.1-RELEASE via pfBlockerNG Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package	Pfsense
CVE-2026-78849	Sep 04, 2026	XSS in Netgate pfSense CE <=2.8.1 Captive Portal Widget Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file	Pfsense Ce
CVE-2026-38961	Sep 04, 2026	XSS in Netgate pfSense RSS Widget (V2.8.1, 25.11.1/26.03) Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any authenticated user who views the dashboard, due to insufficient sanitization of feed title data before rendering in the widget.	Pfsense
CVE-2026-56128	Sep 03, 2026	Authenticated XSS via schedule descr param in pfSense <26.07/CE <2.9 pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an HTML attribute value in /firewall_rules.php with only single-quote escaping applied, permitting double-quote breakout. The payload executes in the browser of any user with the Firewall: Rules privilege who views the rules list with the affected schedule attached.	Pfsense Plus Pfsense Ce Pfsense And others...
CVE-2026-56127	Sep 03, 2026	pfSense Plus <=26.07 & CE <=2.9.0 Auth XSS via firewall descr pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered without encoding in the firewall log table in /status_logs_filter.php. The payload executes in the browser of any user with the Status: Logs: Firewall privilege who views the affected log entries.	Pfsense Plus Pfsense Ce Pfsense And others...
CVE-2026-56126	Sep 03, 2026	Auth JS Injection in pfSense <=26.07 / CE 2.9.0 via /status_monitoring.php pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.	Pfsense Plus Pfsense Ce Pfsense And others...
CVE-2026-67189	Aug 19, 2026	pfSense (Plus & CE) Stored XSS in Traffic Graphs TopTalkers (v26.07/2.8.1) pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned by reverse DNS lookups are incorporated without sanitization into AJAX responses and rendered as HTML through a DOM sink in the administrator interface. An attacker who controls a PTR record and generates sufficient traffic to appear as a top talker can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session context and same-origin access to the firewall management interface, enabling account creation and arbitrary OS command execution.	Pfsense Plus Pfsense Ce Pfsense And others...
CVE-2025-69690	May 08, 2026	pfSense CE 2.7.2 RCE via Module Installer Serialized PHP Object Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property. NOTE: the Supplier disputes this because this installer is only available to admins and they are intentionally allowed to execute PHP code.	Pfsense
CVE-2025-69691	May 08, 2026	Netgate pfSense CE 2.8.0 XMLRPC API Code Execution Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this because the API call is only available to admins and they are intentionally allowed to execute PHP code.	Pfsense Ce
CVE-2016-20058	Apr 04, 2026	Netgate AMITI Antivirus 23.0.305 Unquoted Service Path Priv Esc Vulnerability Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivirusHealth services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted service path and trigger service restart or system reboot to execute code with LocalSystem privileges.	Amiti Antivirus
CVE-2016-20057	Apr 04, 2026	NetGate Registry Cleaner 16.0.205 Unquoted Service Path Vulnerability NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that allows local attackers to escalate privileges by exploiting the service binary path. Attackers can place a malicious executable in the unquoted path and trigger service restart or system reboot to execute code with LocalSystem privileges.	Registry Cleaner
CVE-2019-25271	Feb 04, 2026	NETGATE Data Backup 3.0.620 NGDatBckpSrv Unquoted Path LocalSys Exec NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with LocalSystem privileges by placing executable files in specific directory locations.
CVE-2019-25269	Feb 04, 2026	Unquoted Service Path in Amiti Antivirus 25.0.640 (Windows) Amiti Antivirus 25.0.640 contains an unquoted service path vulnerability in its Windows service configurations. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges by placing executable files in specific directory locations.	Amiti Antivirus
CVE-2025-12490	Nov 06, 2025	Netgate pfSense Suricata Path Traversal RCE Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of Netgate pfSense. Authentication is required to exploit this vulnerability. The specific flaw exists within the Suricata package. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of root. Was ZDI-CAN-28085.	Pfsense
CVE-2025-34178	Sep 09, 2025	pfSense CE Stored XSS in suricata_app_parsers.php via policy_name In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.	Pfsense Ce Pfsense Plus
CVE-2025-34177	Sep 09, 2025	Stored XSS in pfSense CE Suricata suricata_flow_stream.php In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.	Pfsense Ce Pfsense Pfsense Plus And others...
CVE-2025-34176	Sep 09, 2025	CVE-2025-34176: Authenticated Directory Traversal in pfSense Suricata IP Rep In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the file exists, which enables an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.	Pfsense Ce Pfsense Plus
CVE-2025-34175	Sep 09, 2025	XSS via unsanitized filehash on pfSense CE suricata_filecheck.php In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.	Pfsense Ce Pfsense Pfsense Plus And others...
CVE-2025-34174	Sep 09, 2025	Stored-XSS in pfSense CE Status Traffic Totals Page via unsanitized start-day In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.	Pfsense Ce Pfsense Pfsense Plus And others...
CVE-2025-34173	Sep 09, 2025	Directory Traversal in pfSense CE Snort Module Reveals File Existence In pfSense CE /usr/local/www/snort/snort_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, which allows an attacker to enumerate files on the target. The attacker must be authenticated with at least "WebCfg - Services: Snort package" permissions.	Pfsense Ce Pfsense Plus
CVE-2025-34172	Sep 09, 2025	XSS in pfSense CE via showsticktablecontent GET param In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated.	Pfsense Ce Pfsense Plus
CVE-2025-53392	Jun 28, 2025	pfSense CE 2.8.0 WebCfg Diag: Command dir traversal via diag_command.php In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's perspective is that this is intended behavior for this privilege level, and that system administrators are informed through both the product documentation and UI.	Pfsense Ce
CVE-2024-54779	May 14, 2025	XSS in pfSense CE Log Widget <2.8.0 beta – Netgate Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross Site Scripting (XSS) in widgets/log.widget.php.	Pfsense Ce Pfsense Plus
CVE-2024-57273	May 14, 2025	CVE-2024-57273: pfSense CE <2.8.0 beta XSS in ACB 'reason' field Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds is vulnerable to Cross-site scripting (XSS) in the Automatic Configuration Backup (ACB) service, allowing remote attackers to execute arbitrary JavaScript, delete backups, or leak sensitive information via an unsanitized "reason" field and a derivable device key generated from the public SSH key.	Pfsense Ce Pfsense Plus Pfsense And others...
CVE-2024-54780	May 14, 2025	Netgate pfSense CE <2.8.0 Beta: OpenVPN Widget CMD Injection via remipp Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting arbitrary OpenVPN management commands via the remipp parameter.	Pfsense Ce Pfsense Plus Pfsense And others...
CVE-2024-46538	Oct 22, 2024	XSS in pfSense v2.5.2 via interfaces_groups_edit.php ($pconfig injection) A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.	Pfsense
CVE-2023-48795	Dec 18, 2023	OpenSSH <9.6 BPP handshake flaw allows integrity bypass (Terrapin attack) The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.	Pfsense Plus Pfsense Ce
CVE-2023-48123	Dec 06, 2023	RCE via packet_capture.php in Netgate pfSense v23.05.1 An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.	Pfsense Pfsense Plus
CVE-2023-42326	Nov 14, 2023	Netgate pfSense 2.7.0 RCE via interfaces_gif_edit.php/gre_edit.php An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.	Pfsense Pfsense Plus