Security readout for executives and security teams
Plain-English summary
CVE-2019-16914 is a cross-site scripting issue in pfSense through 2.4.4-p3. Certain captive portal MAC page parameters could be displayed without sanitization, allowing malicious script content to appear in the interface if a victim views crafted input.
Executive priority
Prioritize remediation for internet-adjacent or broadly administered pfSense systems. The issue is not documented here as actively exploited, but XSS in firewall administration workflows can still create operational risk.
Technical view
The flaw is in services_captiveportal_mac.php, where username and delmac parameters are reflected without sanitization. The source bundle identifies pfSense through 2.4.4-p3 as affected and links a pfSense issue and code commit, but provides no CVSS score or CWE details.
Likely exposure
Exposure is most likely on pfSense deployments running through 2.4.4-p3 where the affected captive portal MAC management page is accessible to users who can submit or view those parameters.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation evidence. Public issue and commit references exist, so defenders should assume the bug details are discoverable.
Researcher notes
Evidence is limited to the CVE description, pfSense issue, code commit, and Seebug reference. Do not infer unauthenticated reachability, session theft, or specific exploitability beyond reflected unsanitized username and delmac handling.
Mitigation direction
- Identify pfSense systems running through 2.4.4-p3.
- Review pfSense vendor guidance and issue 9609 for fixed release details.
- Apply a vendor-supported update beyond the affected range when confirmed.
- Restrict pfSense administrative and captive portal management access to trusted networks.
- Monitor for unexpected script content or suspicious parameter values in relevant logs.
Validation and detection
- Inventory pfSense versions and flag any through 2.4.4-p3.
- Confirm whether services_captiveportal_mac.php exists on managed systems.
- Review change records for the referenced pfSense commit or equivalent vendor fix.
- Check access controls around captive portal MAC administration pages.
- Document whether captive portal functionality is enabled or exposed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-16914 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://redmine.pfsense.org/issues/9609CVE reference · x_refsource_MISC
- https://github.com/pfsense/pfsense/commit/d31362b69d5d52dc196dc72f66e830cd1e6e9a4fCVE reference · x_refsource_MISC
- https://www.seebug.org/vuldb/ssvid-98023CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.