Vulnerability record · CVE-2023-42326 · published 14 November 2023
CVE-2023-42326: pfSense WebGUI GIF/GRE Interface Command Injection
Netgate · Pfsense
Netgate pfSense 2.7.0 contains a command injection flaw in the interfaces_gif_edit.php and interfaces_gre_edit.php WebGUI components. A remote attacker can send a crafted request to execute arbitrary code on the firewall. Because pfSense is a perimeter device, compromise can expose or disrupt the protected network.
Description
An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with network reachability and high EPSS (99th percentile) make this a serious risk for internet-exposed pfSense management interfaces, though it requires low-privileged credentials and is not in KEV.
What it is
Netgate pfSense 2.7.0 contains a command injection flaw in the interfaces_gif_edit.php and interfaces_gre_edit.php WebGUI components. A remote attacker can send a crafted request to execute arbitrary code on the firewall. Because pfSense is a perimeter device, compromise can expose or disrupt the protected network.
Impact
An attacker with valid credentials gains arbitrary command execution on the pfSense appliance, leading to full compromise of confidentiality, integrity and availability of the firewall and potentially the networks behind it.
Attack surface
Reachable over the network through the pfSense WebGUI (AV:N) via crafted requests to the GIF and GRE interface edit pages. The CVSS vector requires low privileges (PR:L) and no user interaction (UI:N), so a valid low-privileged WebGUI account is needed.
Exploitation
Not listed in CISA KEV and no ransomware usage documented. EPSS is high (0.64021, 99.186th percentile), indicating elevated likelihood of exploitation activity, but the record does not confirm public exploit code.
What to do
- Apply the Netgate vendor advisory pfSense-SA-23_10.webgui fix and upgrade to a patched pfSense release.
- Restrict WebGUI access to trusted management networks and disable WAN-side GUI access.
- Enforce least privilege on WebGUI accounts and remove unused or low-privileged accounts.
- Monitor and alert on unexpected changes to GIF/GRE interface configuration.
- Review firewall and system logs for suspicious requests to interfaces_gif_edit.php and interfaces_gre_edit.php.
Detection
- Alert on HTTP requests to interfaces_gif_edit.php or interfaces_gre_edit.php containing shell metacharacters or unusual parameters.
- Monitor pfSense system logs and shell history for unexpected command execution or child processes spawned by the web server.
- Audit GIF/GRE interface configuration changes and correlate them with authenticated WebGUI sessions.
- Watch for outbound connections or new listeners originating from the pfSense appliance.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-42326 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-42326), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
