The vulnerability is a reflected cross‑site scripting flaw in firewall_rules.php that allows a remote attacker to inject arbitrary JavaScript via the unencoded 'if' URL parameter. The flaw is exploitable when the non‑default Require Firewall Interface option is enabled, permitting the attacker’s script to run with the privileges of any user who opens the crafted link. This can lead to session theft, privilege hijack, or interface defacement. The attack vector is inferred to involve the attacker sending a malicious GET request to a victim with firewall rule management rights.

Netgate pfSense Community Edition versions 2.7.1 through 2.9.0 are vulnerable. Users running any of these releases are at risk until a newer version is deployed.

The CVSS score of 2.3 indicates low overall severity, yet the impact of executing code within the WebGUI could compromise the administrative interface for users with firewall rule privileges. EPSS data is unavailable and the flaw is not listed in CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. However, exploitation requires a crafted URL and a user with sufficient privileges, limiting immediate exposure but still presenting a significant risk to authenticated administrators.