pfSense Plus vulnerabilities

6 known vulnerabilities in pfSense Plus from Netgate. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  pfSense Plus: Path Traversal: '../filedir'

  CVE-2026-97730Sep 25, 2026NetgateEPSS 1.03%

  In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker

• 8.8 High severity

  Pfsense Ce: Improper Control of Generation of Code

  CVE-2024-54780May 14, 2025NetgateEPSS 12.7%

  Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can expl

• 8.8 High severity

  Pfsense: Improper Neutralization of Special Elements used in a Command

  CVE-2023-42326Nov 14, 2023NetgateEPSS 64.3%

  An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.

• 9.8 Critical severity

  Pfsense Plus: Improper Restriction of Excessive Authentication Attempts

  CVE-2023-27100Mar 22, 2023NetgateEPSS 9.92%

  Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE software v2.6.0 allows attackers to bypass brute force protection mechanisms via crafted web requests.

• 8.8 High severity

  pfSense CE and pfSense Plus: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2022-26019Mar 31, 2022pfSenseEPSS 4.5%

  Improper access control vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing file

• 8.8 High severity

  Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software…

  CVE-2022-24299Mar 31, 2022pfSenseEPSS 1.93%

  Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to ex