CVE-2025-34174: falha de média gravidade em Netgate pfSense CE
Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
18Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 17%
In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
Netgate · pfSense CECVEs relacionadas — Netgate pfSense CE
No mesmo produto, das mais perigosas para as menos.
CVE-2025-34175MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Reflected Cross-Site ScriptingEPSS 24.0%CVE-2025-34176MEDIUMNetgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information DisclosureEPSS 20.5%CVE-2026-111214HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via interfaces_qinq_edit.phpEPSS 10.8%CVE-2026-111218HIGHNetgate pfSense CE 2.7.0 through 2.9.0 OS Command Injection via Traffic Shaper LimitersEPSS 8.6%CVE-2026-111217HIGHNetgate pfSense CE through 2.9.0 OS Command Injection via CARP VHIDEPSS 7.0%CVE-2025-34178MEDIUMNetgate pfSense CE Suricata package v7.0.8_2 Stored Cross-Site ScriptingEPSS 6.6%