CVE-2025-34178: medium-severity vulnerability in Netgate pfSense CE
Netgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 6.6%
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
Netgate · pfSense CERelated CVEs — Netgate pfSense CE
In the same product, most dangerous first.
CVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 24.0%CVE-2025-34176MEDIUMNetgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information DisclosureEPSS 20.5%CVE-2025-34174MEDIUMNetgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site ScriptingEPSS 17.3%CVE-2026-111214HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.phpEPSS 10.8%CVE-2026-111218HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper LimitersEPSS 8.6%CVE-2026-111217HIGHNetgate pfSense CE through 2.9.0 OS Command Injection via CARP VHIDEPSS 7.0%