PT-2025-44164 · Ipfire · Ipfire

Alex Williams · Published 2025-10-28 · Updated 2025-10-28 · CVE-2025-34305

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 (Core Update 198)

Description IPFire installations are affected by multiple stored cross-site scripting (XSS) issues. These occur because the cleanhtml() function located at /var/ipfire/header.pl does not correctly apply HTML-entity encoding to user-provided input. Specifically, after calling escape() and HTML::Entities::encode entities(), the sanitized result is not assigned back to the output variable, leaving the original, unsanitized data vulnerable. This allows malicious scripts to be stored and executed when other users view the affected entries. The following API endpoints are impacted: /cgi-bin/wakeonlan.cgi (with the CLIENT COMMENT parameter), /cgi-bin/dhcp.cgi (with the ADVOPT DATA, FIX REMARK, FIX FILENAME, and FIX ROOTPATH parameters), /cgi-bin/connscheduler.cgi (with the ACTION COMMENT parameter), /cgi-bin/dnsforward.cgi (with the REMARK parameter), /cgi-bin/vpnmain.cgi (with the REMARK parameter), and /cgi-bin/dns.cgi (with the REMARK parameter).

Recommendations Update IPFire to version 2.29 (Core Update 198) or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-34305

Affected Products

Ipfire

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-34305 · Security Note
• https://osv.dev/vulnerability/CVE-2025-34305 · Vendor Advisory
• https://twitter.com/CVEnew/status/1983185720274559199 · Twitter Post
• https://vulncheck.com/advisories/ipfire-stored-xss-via-multiple-methods-in-cleanhtml · Note
• https://bugzilla.ipfire.org/show_bug.cgi?id=13880 · Note
• https://ipfire.org/blog/ipfire-2-29-core-update-198-released · Patch, Vendor Advisory