PT-2026-8246 · Opnsense · Opnsense

Ozer Goker · Published 2026-02-15 · Updated 2026-02-15 · CVE-2019-25374

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OPNsense version 19.1

Description OPNsense 19.1 contains a reflected cross-site scripting issue that allows attackers to inject malicious scripts. This is possible by exploiting the passthrough networks parameter in the 'vpn ipsec settings.php' file. Attackers can send POST requests containing JavaScript payloads within the passthrough networks parameter, leading to the execution of arbitrary code in users’ browsers. The vulnerable file is 'vpn ipsec settings.php' and the vulnerable parameter is passthrough networks.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25374

Affected Products

Opnsense

References · 7

• 🔥 https://exploit-db.com/exploits/46351 · Exploit
• https://osv.dev/vulnerability/CVE-2019-25374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25374 · Security Note
• https://forum.opnsense.org/index.php?topic=11469.0 · Patch
• https://vulncheck.com/advisories/opnsense-reflected-xss-via-vpnipsecsettingsphp · Note
• https://t.me/CVEtracker/44768 · Telegram Post
• https://opnsense.org · Note