CVE-2019-12347: pfSense stored XSS in ACME account key Name/Description fields

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

medium priorityCVSS rates it medium (6.1) and it requires user interaction, but the target is a security appliance admin interface and public exploit code exists.

What it is

pfSense 2.4.4-p3 fails to validate input in the Name and Description fields handled by acme_accountkeys_edit.php, allowing a stored cross-site scripting payload to be saved. The injected script then executes in the browser of anyone viewing the affected page, which matters because pfSense is a security appliance whose admin interface is a high-value target.

Impact

An attacker can run arbitrary script in the context of a pfSense administrator's session, enabling session theft, credential capture or unauthorized actions through the admin UI. The CVSS scope change (S:C) reflects that the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network through the pfSense web interface; the CVSS vector shows no privileges required (PR:N) but user interaction required (UI:R), meaning a victim must view the page containing the stored payload.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.586 (99th percentile) and multiple references are tagged Exploit, indicating public proof-of-concept code exists.

What to do

• Upgrade pfSense to a release containing the fix referenced in the vendor commit and advisory; patch first.
• Restrict access to the pfSense web interface to trusted management networks and avoid exposing it to the internet.
• Enforce strict output encoding and input validation on the Name and Description fields in acme_accountkeys_edit.php if running an unpatched build.
• Review ACME account key entries for unexpected or script-like content and remove any suspicious values.

Detection

• Search pfSense ACME account key Name and Description fields for HTML or script tags and other encoded payload patterns.
• Monitor web server and audit logs for requests to acme_accountkeys_edit.php with suspicious parameter values.
• Alert on anomalous admin session activity or unexpected configuration changes following ACME key edits.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.