Read the docs
TI-2025-24331 Aliases CVE-2025-34182GHSA-v8ch-859h-ggwh

Deciso OPNsense < 25.7.4 /interfaces_ppps_edit.php ptpid Stored XSS

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00335 27th percentileScored 2026-11-07
Fix Fixed OPNsense (Deciso): 25.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DecisoOPNsensebefore 25.7.425.7.4Patch availableCNA
  • OPNsense VendorDeciso Affected before 25.7.4 Fixed in 25.7.4 Patch available CNA

Remediation

  • Fix · CNA OPNsense (Deciso) Fixed in 25.7.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34182
  2. 2026-10-03 Alias added: GHSA-v8ch-859h-ggwh

References

Patch 1

  • TI-2026-01692 OS command injection in Deciso OPNsense CVSS 3.0MEDIUM 6.8
  • TI-2025-12519 Path traversal in Deciso OPNsense CVSS 3.0MEDIUM 4.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences