Medium severity · published Sep 9, 2025
CVE-2025-34174
Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting
5.4
CVSS
14.5%
EPSS
No
On KEV
Description
In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)14.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
pfSense CE · Netgate
2.3.2_7 · source: vendor
PF
Pfsense · Pfsense
before 2.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-34174
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-34174
Patch
https://github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893
Issue Tracking
https://redmine.pfsense.org/issues/16413
Third Party Advisory
https://www.vulncheck.com/advisories/netgate-pf-sense-ce-status-traffic-totals-stored-xss
More from pfSense CE
8.8
CVE-2026-111225
Netgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.sh
8.8
CVE-2024-54780
Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of…
8.5
CVE-2026-97730
In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dashboard (index.php) widget sequence data handling allows an…
7.5
CVE-2026-111224
Netgate pfSense CE through 2.9.0 OS Command Injection via openvpn.connect_async.sh
7.2
CVE-2026-111231
Netgate pfSense CE through 2.9.0 Authorization Bypass via config_restore() and config_install()