Medium severity5.4NVD Advisory· Published Sep 9, 2025· Updated Jun 17, 2026

CVE-2025-34174

Description

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pfsense/Pfsense2 versions
cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*+ 1 more
- cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:*range: <2.8.0
- (no CPE)
Netgate/Pfsense Cellm-fuzzy
Netgate/Pfsensecpe-rescue
Range: 2.3.2_7

Patches

Vulnerability mechanics

References

github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893nvdPatch
www.vulncheck.com/advisories/netgate-pf-sense-ce-status-traffic-totals-stored-xssnvdThird Party Advisory
redmine.pfsense.org/issues/16413nvdIssue Tracking

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.008
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000