CVE-2023-42325: pfSense WebGUI status_logs_filter_dynamic.php reflected XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityCVSS rates it medium (5.4) and it requires an authenticated, interacting victim, but the high EPSS and vendor Exploit tag raise the practical risk for exposed WebGUI instances.

What it is

Netgate pfSense 2.7.0 contains a reflected cross-site scripting flaw in the status_logs_filter_dynamic.php page, where a crafted URL can inject script into the response. Because the page is part of the administrative WebGUI, successful exploitation can run script in the context of a logged-in administrator and lead to privilege gain.

Impact

An attacker who lures a privileged pfSense user to a crafted URL can execute script in that user's browser session, potentially performing administrative actions or stealing session data. The CVSS scope change (S:C) reflects that the impact can extend beyond the vulnerable component.

Attack surface

Reached over the network via a crafted URL to the WebGUI page status_logs_filter_dynamic.php. The vector requires low privileges (PR:L) and user interaction (UI:R), so the victim must be authenticated and induced to open the link.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded. EPSS is high (0.57918, 99th percentile) and the vendor advisory is tagged Exploit, indicating public exploit detail exists, but the record does not confirm active exploitation.

What to do

• Apply the Netgate pfSense security advisory SA-23_09 update for the WebGUI; patch first.
• Restrict WebGUI access to trusted management networks and avoid exposing it to the internet.
• Require administrators to re-authenticate and rotate credentials if a suspicious crafted URL was opened.
• Train privileged users not to follow untrusted links to pfSense admin pages.

Detection

• Review WebGUI access logs for requests to status_logs_filter_dynamic.php containing script-like or encoded payloads in query parameters.
• Alert on anomalous administrative sessions or actions following visits to crafted URLs.
• Monitor for unexpected outbound connections or credential use from administrator browsers.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.