CVE-2026-78902 turns a single DNS request into root on pfSense. An attacker on the LAN poisons the pfBlockerNG reply log via crafted DNS TXT RDATA, triggering stored XSS that chains to full RCE when an admin loads the Stats tab. - CVE-2026-78902 affects pfBlockerNG on pfSense when Unbound Python mode and DNS Reply Logging are both enabled. The flaw originates in pfb_unbound.py: convert_other() passes printable ASCII chars including <, >, ", and = through without sanitization, and the resulting r_addr value is written raw into /var/log/pfblockerng/dns_reply.log and unified.log. - pfblockerng_alerts.php renders $fields[8] (the resolved address) directly into HTML with no htmlspecialchars() call, both in visible cell content and a title attribute. The Stats tab is the dangerous sink: it reads the full log file, de-duplicates with uniq -c, and renders aggregated values into table cells, filter-button attributes, and pie chart labels, all unescaped, persisting for the lifetime of the log entry. - The full chain: attacker controls a DNS server returning a crafted TXT record, forces any LAN client to resolve it through pfSense, payload is logged, admin views Stats tab, XSS fires, fetches /diag_command.php, scrapes a CSRF token, POSTs a shell command, and a reverse root shell connects back. - Netgate patched within 24 hours (v. #DFIR_Radar
