CVE-2025-34182mediumCWE-79

CVE-2025-34182: falha de média gravidade em Deciso OPNsense

Deciso OPNsense < 25.7.4 /interfaces_ppps_edit.php ptpid Stored XSS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar OPNsense

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.3%
In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements."
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
Deciso · OPNsense
CVEs relacionadas — Deciso OPNsense

No mesmo produto, das mais perigosas para as menos.

CVE-2026-2035MEDIUMDeciso OPNsense diag_backup.php filename Command Injection Remote Code Execution VulnerabilityEPSS 1.6%CVE-2025-13698MEDIUMDeciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation VulnerabilityEPSS 0.6%