CVE-2024-46538: pfSense interfaces_groups_edit.php XSS via $pconfig variable

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

medium priorityRequires high privileges and user interaction, limiting practical exploitation, though a public exploit and high EPSS score warrant attention.

What it is

A cross-site scripting flaw exists in pfSense v2.5.2 where a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php allows execution of arbitrary web scripts or HTML. It matters because an authenticated administrator viewing the affected page could have script run in their browser session.

Impact

An attacker can execute arbitrary web scripts or HTML in the context of a victim's browser session. Given the privileged nature of the pfSense admin interface, this could enable session theft or administrative actions performed as the victim.

Attack surface

The vulnerability is network-reachable (AV:N) but requires high privileges (PR:H) and user interaction (UI:R), meaning an attacker must already have administrative access and convince a victim to interact with a crafted page or link.

Exploitation

A public exploit reference exists on GitHub, and EPSS indicates a high probability of exploitation activity (0.81583, 99.6th percentile), but the CVE is not listed in CISA KEV.

What to do

• Upgrade pfSense to a version later than 2.5.2 that contains the vendor fix referenced in the Redmine advisory.
• Restrict administrative access to the pfSense web interface to trusted networks and users.
• Apply input validation or output encoding to the $pconfig variable handling in interfaces_groups_edit.php if custom code is maintained.
• Educate administrators not to follow untrusted links or open crafted pages while logged into pfSense.

Detection

• Monitor web server logs for requests to interfaces_groups_edit.php containing suspicious script or HTML payloads in parameters.
• Review administrator browser sessions for unexpected script execution or anomalous DOM activity on pfSense admin pages.
• Audit changes to interface group configurations for signs of injected content.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.