What’s Vulnerable › Vulnerabilities

CVE-2025-34174: Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 14.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-09 · updated 2026-06-17
• Weakness: CWE-79

Description

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.

Affected products

• Netgate pfSense CE: before 2.8.0 — fixed in 2.8.0

How to fix

Upgrade to a fixed version: Netgate pfSense CE 2.8.0. Check the vendor advisory for mitigations.

References

• https://github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893
• https://redmine.pfsense.org/issues/16413
• https://www.vulncheck.com/advisories/netgate-pf-sense-ce-status-traffic-totals-stored-xss

Get alerted when CVE-2025-34174 or the next vulnerability affects your stack