What happened
An active vulnerability has been identified in Netgate pfSense Plus versions prior to 26.07 and pfSense CE versions prior to 2.9.0. This flaw concerns the Dashboard widget sequence data handling, which contains a Local File Inclusion (LFI) vulnerability. An authenticated attacker with privileges to alter Dashboard settings can exploit this weakness by submitting a crafted widget sequence value containing a path traversal payload. This leads to the reading and execution of arbitrary PHP files on the affected system, such as those placed in the /tmp directory. The attacker can execute malicious code as if it were a standard widget, resulting in potentially severe consequences if exploited successfully. The exploit requires the attacker to have prior access to modify dashboard configurations but does not necessitate user interaction for execution. The vulnerability has been rated as high severity, with a CVSS score of 8.5, given the potential for remote code execution with minimal privileges. The flaw stems from inadequate validation of inputs used in widget sequence processing, classified under CWE-24. The vulnerability’s successful exploitation hinges on an exposed service accessible over the network and the attacker’s ability to implement path traversal payloads.
Who is affected
Organisations running affected versions of Netgate pfSense Plus prior to 26.07 or pfSense CE prior to 2.9.0 are susceptible to this vulnerability. Any deployment where the Dashboard functionality is accessible and changes to the widget sequence can be made by authenticated users may be at risk. Since the vulnerability can be exploited over a network, it implicates systems exposed to untrusted or less-trusted networks, particularly where access controls are insufficient. The issue primarily affects the Dashboard component, a common element in network security appliances and network management systems based on pfSense.
Recommended actions
To mitigate this vulnerability, affected organisations should consider implementing network controls to restrict access to the relevant services, effectively reducing the attack surface. Network segmentation and access control policies should be reviewed and enforced to prevent unauthenticated or low-privileged users from modifying Dashboard settings. Patch management procedures should be closely followed once patches for this vulnerability become available, as current remediation paths are not specified. Administrators should monitor for any unusual activity indicative of exploitation attempts, especially involving modifications to Dashboard configurations or the presence of arbitrary PHP files in system directories. Ensuring that access to management interfaces is secured from external networks can further reduce the risk of exploitation.
Indicators of compromise
This section is not provided as no specific indicators of compromise have been supplied or confirmed at this time.
