CVE-2026-67189: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Netgate pfSense Plus

The vulnerability in pfSense Plus and pfSense CE involves improper neutralization of input during web page generation, specifically in the Traffic Graphs top-talkers feature. PTR records returned by reverse DNS lookups are incorporated into AJAX responses without proper sanitization and rendered as HTML in the admin interface. An attacker who controls a PTR record and causes sufficient traffic to be listed as a top talker can inject and execute arbitrary JavaScript in the administrator's browser. This cross-site scripting flaw allows the attacker to hijack the authenticated session, gain same-origin access to the firewall management interface, create accounts, and execute arbitrary operating system commands.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the administrator's browser session. This leads to theft of authenticated session credentials, unauthorized access to the firewall management interface, creation of new administrative accounts, and arbitrary command execution on the underlying operating system. The vulnerability thus compromises the confidentiality, integrity, and availability of the firewall system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Traffic Graphs feature to trusted administrators only and monitor for suspicious PTR records or anomalous traffic patterns that could indicate exploitation attempts.