pfSense

The page at services_dhcpv6.php does not perform sufficient validation on the user input value of Delegated Length (pddellen) when saving settings. This value is subsequently used in JavaScript without encoding if the DHCP backend is set to Kea, which is a potential XSS vector.

The pdprefixlen also lacks sufficient validation, but it does not appear to be vulnerable.

Creating an entry with a value such this example reproduces the problem condition:

{
    "if": "lan",
    "pdprefix": "2001:db8:12:34::",
    "pdprefixlen": "64",
    "pddellen": '64" || alert(\"XSS\") || \"'
    "denyunknown": "disabled",
    "save": "Save",
}

Simple POC attached.