CVE-2024-46538

Deeper analysis

CVE-2024-46538 is a stored cross-site scripting vulnerability in pfSense version 2.5.2. The flaw resides in the interfaces_groups_edit.php page, where unsanitized input supplied to the $pconfig variable is later rendered without proper encoding, allowing arbitrary HTML or JavaScript to be injected into the administrative web interface.

An authenticated administrator can exploit the issue by submitting a crafted payload that is stored and subsequently executed in the browsers of other users who view the affected page. Successful exploitation yields the ability to perform actions within the pfSense web GUI under the context of the victim account, such as modifying interface group settings or exfiltrating session data, though the attack requires high privileges and user interaction.

The EPSS score for this vulnerability stands at 0.8365 with no material increase from a lower baseline after disclosure. Public references include a detailed technical write-up on GitHub and the corresponding pfSense Redmine issue tracker entry.