CVE-2025-34174: Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting
In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34174?
CVE-2025-34174 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2025-34174?
To mitigate CVE-2025-34174, sanitize and validate the start-day parameter input before displaying it in the application.
Which versions are affected by CVE-2025-34174?
CVE-2025-34174 affects users of the Netgate pfSense CE Status_Traffic_Totals Package.
What type of vulnerability is CVE-2025-34174?
CVE-2025-34174 is a cross-site scripting (XSS) vulnerability due to improper handling of user input.
What impact can CVE-2025-34174 have on applications?
Exploitation of CVE-2025-34174 may allow attackers to execute malicious scripts in the context of the affected user's session.