Vulnerability · Published Sep 9, 2025 · Assigned by VulnCheck

CVE-2025-34174Netgate pfSense CE Status_Traffic_Totals Package v2.3.2_7 Stored Cross-Site Scripting

Medium 5.1

In plain English

A medium-severity cross-site scripting in pfSense CE from Netgate. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 14.5% (higher than 97% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)14.5%top 3.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.

Affected products (as reported)

Vendor	Product	Versions
Netgate	pfSense CE	2.3.2_7

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893 patch
https://redmine.pfsense.org/issues/16413 issue-tracking
https://www.vulncheck.com/advisories/netgate-pf-sense-ce-status-traffic-totals-stored-xss third-party-advisory