CVE-2015-2295: pfSense WebGUI CSRF in full backup restore deletes arbitrary files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityThe flaw affects a security-critical firewall management interface, public exploit code exists, and EPSS is very high, though exploitation requires an authenticated admin to be tricked into a CSRF.

What it is

pfSense before 2.2.1 contains a cross-site request forgery flaw in system_firmware_restorefullbackup.php in the WebGUI. An attacker can force a logged-in administrator's browser to submit a crafted request that deletes arbitrary files via the deletefile parameter. Because the target is a firewall management interface, file deletion can undermine device integrity and availability.

Impact

An attacker who lures an authenticated administrator into a malicious page can cause deletion of arbitrary files on the pfSense appliance, potentially breaking configuration, logging or the WebGUI itself. The attacker does not gain direct code execution from this flaw alone.

Attack surface

Reached over the network through the pfSense WebGUI; the victim must be an authenticated administrator and must be induced to load attacker-controlled content, so user interaction is required. No attacker authentication is needed beyond the victim's existing session.

Exploitation

Public exploit references exist (Packet Storm, Exploit-DB, HTB advisory), and EPSS is 0.65722 (99.23rd percentile), indicating high predicted exploitation activity, though the CVE is not listed in CISA KEV.

What to do

• Upgrade pfSense to 2.2.1 or later, which fixes the WebGUI CSRF issue.
• Restrict WebGUI access to trusted management networks and never expose it to the internet.
• Require administrators to log out of the WebGUI when not in use and avoid browsing untrusted sites in the same browser session.
• Apply anti-CSRF protections at the reverse proxy or WAF in front of the WebGUI where feasible.

Detection

• Monitor WebGUI access logs for POST requests to system_firmware_restorefullbackup.php, especially with a deletefile parameter.
• Alert on unexpected file deletions or missing configuration files on pfSense appliances.
• Correlate administrator browser sessions with outbound requests to untrusted or newly registered domains.
• Review pfSense audit or system logs for backup restore actions that were not initiated by an administrator.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.