PT-2026-20500 · Ipfire · Ipfire

Ozer Goker · Published 2026-02-18 · Updated 2026-02-18 · CVE-2019-25398

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IPFire version 2.21 Core Update 127

Description The software contains multiple cross-site scripting issues in the ovpnmain.cgi script. Attackers can inject malicious scripts through VPN configuration parameters by submitting POST requests. Specifically, attackers can leverage parameters such as VPN IP, DMTU, ccdname, ccdsubnet, DOVPN SUBNET, DHCP DOMAIN, DHCP DNS, DHCP WINS, ROUTES PUSH, FRAGMENT, KEEPALIVE 1, and KEEPALIVE 2 to execute arbitrary JavaScript in administrator browsers. The API endpoint involved is the ovpnmain.cgi script.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25398

Affected Products

Ipfire

References · 6

• 🔥 https://exploit-db.com/exploits/46344 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25398 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25398 · Vendor Advisory
• https://downloads.ipfire.org/releases/ipfire-2.x/2.21-core127/ipfire-2.21.x86_64-full-core127.iso · Patch
• https://vulncheck.com/advisories/ipfire-core-update-cross-site-scripting-via-ovpnma · Note
• https://ipfire.org · Note