PT-2025-21161 · Netgate · Pfsense Ce

Published 2024-11-15 · Updated 2025-06-23 · CVE-2024-54779

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Netgate pfSense CE versions prior to 2.8.0 beta release Netgate pfSense CE corresponding Plus builds versions prior to 2.8.0 beta release

Description: The issue is related to Cross Site Scripting (XSS) in the widgets/log.widget.php file. This allows for potential malicious script execution.

Recommendations: For versions prior to 2.8.0 beta release, update to version 2.8.0 beta or later to resolve the issue. For corresponding Plus builds prior to 2.8.0 beta release, update to the corresponding Plus build of version 2.8.0 beta or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00175

CVE-2024-54779

Affected Products

Pfsense Ce

References · 13

• 🔥 https://blog.brillantit.com/exploiting-pfsense-xss-command-injection-cloud-hijack · Exploit
• https://osv.dev/vulnerability/CVE-2024-54779 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00175 · Security Note
• https://docs.netgate.com/downloads/pfSense-SA-25_01.webgui.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54779 · Security Note
• https://twitter.com/CVEnew/status/1922695654369001833 · Twitter Post
• https://t.me/cvetracker/23828 · Telegram Post
• https://t.me/cvenotify/126394 · Telegram Post
• https://t.me/cvenotify/122763 · Telegram Post
• http://netgate.com · Note
• https://t.me/cvenotify/122945 · Telegram Post
• https://netgate.com/blog/important-security-updates-for-pfsense-plus-24.11-and-ce-2.7.2 · Note
• https://twitter.com/Secu0133/status/1924106902872428692 · Twitter Post