CyberRota Analysis
AI-GeneratedAuthenticated users with the Status: Monitoring privilege in pfSense Plus versions before 26.07 and CE versions before 2.9.0 can exploit a vulnerability that allows them to inject arbitrary JavaScript through unsanitized graph configuration parameters in the /status_monitoring.php page. This leads to the execution of malicious scripts in the browsers of all users accessing the Status: Monitoring page, posing a risk of session hijacking or data manipulation. Organizations using affected versions of pfSense should prioritize patching to mitigate this security risk.
Original NVD Description
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date, end-date, start-time, end-time, graph-type, invert, and refresh-interval are concatenated and written to the global pfSense XML configuration without sanitization, then echoed unsanitized into a JavaScript string context on page render. Because the setting is stored in the global configuration, the payload executes in the browser of every user who visits the Status: Monitoring page.