CVE-2025-34174 Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting

Medium 5.1 Published 9 Sep 2025 Updated 20 Nov 2025

Authenticated attackers can inject malicious scripts via the start-day parameter in pfSense CE, leading to stored XSS affecting all users.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-34174?

CVE-2025-34174 is a medium-severity cross-site scripting vulnerability in Netgate pfSense CE, published on 9 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.

Weakness: CWE-79

Which versions are affected by CVE-2025-34174?

It affects 1 product.

Products include Pfsense Pfsense.

How do I fix CVE-2025-34174?

No fix has been published for CVE-2025-34174 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-34174 being exploited?

There is no known exploitation of CVE-2025-34174 in the wild and no public exploit code.

Sources

Also known as GHSA-6p4q-ch45-w85q.