The vulnerability allows an authenticated user to inject arbitrary client‑side code through the separator color field used for firewall and NAT rules. When the stored color value is processed by display_separator(), it is placed directly into a class attribute without encoding, enabling scripts to run in the browser of any administrator who visits the page. This can steal session data, manipulate the WebGUI, or perform privileged actions without the user's knowledge. “

Netgate pfSense CE versions 2.3.0 through 2.9.0 are affected. Any installation using the default firewall or NAT rule interface within these releases is vulnerable. The issue does not exist in releases prior to 2.3.0 or in any patch that follows 2.9.0 if it addresses the bug.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers require authentication with either Firewall: Rules or NAT: Port Forward privileges to submit the malicious separator[] value, so the attack vector is a web‑based administrative UI that accepts privileged input. Once a payload is stored, any administrator who views the affected rule list will trigger script execution.