Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-22 | 3 | Disclosure2Patch1 |
| 2026-09-23 | 3 | Disclosure1Patch2 |
pfBlockerNG flaw (CVE-2026-78902): DNS request stores XSS in logs. Admin views Stats page, malicious JS executes, CSRF token stolen, reverse shell launched as root. Netgate patched in 24 hours. Update now. #Pentesting #CyberSecurity https://ow.ly/rLQn50ZQzVw https://t.co/l4r0DsVKk7
Post summary
The tweet announces a vulnerability in pfBlockerNG and emphasizes that a patch has been released, urging users to update.
CVE-2026-78902 turns a single DNS request into root on pfSense. An attacker on the LAN poisons the pfBlockerNG reply log via crafted DNS TXT RDATA, triggering stored XSS that chains to full RCE when an admin loads the Stats tab. - CVE-2026-78902 affects pfBlockerNG on pfSense when Unbound Python mode and DNS Reply Logging are both enabled. The flaw originates in pfb_unbound.py: convert_other() passes printable ASCII chars including <, >, ", and = through without sanitization, and the resulting r_addr value is written raw into /var/log/pfblockerng/dns_reply.log and unified.log. - pfblockerng_alerts.php renders $fields[8] (the resolved address) directly into HTML with no htmlspecialchars() call, both in visible cell content and a title attribute. The Stats tab is the dangerous sink: it reads the full log file, de-duplicates with uniq -c, and renders aggregated values into table cells, filter-button attributes, and pie chart labels, all unescaped, persisting for the lifetime of the log entry. - The full chain: attacker controls a DNS server returning a crafted TXT record, forces any LAN client to resolve it through pfSense, payload is logged, admin views Stats tab, XSS fires, fetches /diag_command.php, scrapes a CSRF token, POSTs a shell command, and a reverse root shell connects back. - Netgate patched within 24 hours (v. #DFIR_Radar
Post summary
The analysis details CVE-2026-78902 (pfSense pfBlockerNG RCE via DNS log poisoning) and confirms that Netgate released a patch within 24 hours of disclosure.
NetSPI disclosed a pfBlockerNG flaw in pfSense where a crafted DNS reply could poison logs, trigger stored XSS in webConfigurator, and chain to root RCE. Fixed quickly, later assigned CVE. #pfSense #pfBlockerNG #Netgate https://www.hendryadrian.com/cve-2026-78902-xss-to-rce-in-pfsense-with-one-dns-request/
Post summary
NetSPI disclosed details of a pfBlockerNG flaw in pfSense where a malicious DNS reply could trigger a stored XSS and ultimately achieve root RCE, highlighting the vulnerability's chain of impact.
pfBlockerNG DNS Reply logging just became a root path. One crafted TXT reply, admin views the Stats tab, you're owned via /diag_command.php. CVE-2026-78902. Get to 3.2.16_1 tonight if that package is installed.
Post summary
The post describes a root‑access vulnerability in pfBlockerNG via a crafted DNS TXT reply and urges users to upgrade to version 3.2.16_1 to address CVE-2026-78902.
TRC analysis shows attackers can exploit CVE-2024-46538 to compromise pfSense firewalls with a single malicious DNS request. The attack chains stored XSS through pfBlockerNG logs to achieve root access on network edge devices. Compromising perimeter infrastructure provides privileged positions for lateral movement into internal network segments. #ZeroTrust #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/cve-2026-78902-xss-rce-pfsense-dns-request
Post summary
The text explains how CVE-2024-46538 can be exploited via a single malicious DNS request that chains stored XSS in pfBlockerNG logs to gain root access on pfSense firewalls, enabling lateral movement. No patches, exploits, or active exploitation are mentioned.
Source: https://www.netspi.com/blog/technical-blog/web-application-pentesting/cve-2026-78902-xss-to-rce-in-pfsense-with-one-dns-request/
Post summary
The post shares a link to a NetSPI blog post disclosing technical details of CVE-2026-78902, describing an XSS-to-RCE exploit chain in pfSense triggered by a single DNS request, without mentioning patches, exploits, or active attacks.