Read the docs
TI-2025-24437 Aliases CVE-2025-34304GHSA-2hwv-ff5w-xmw9

IPFire < v2.29 SQL Injection via OpenVPN Connection Logs

Priority LOW 31CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authenticated attacker to manipulate the SQL query used when viewing OpenVPN connection logs via the CONNECTION_NAME parameter. When viewing a range of OpenVPN connection logs, the application issues an HTTP POST request to the Request-URI /cgi-bin/logs.cgi/ovpnclients.dat and inserts the value of the CONNECTION_NAME parameter directly into the WHERE clause without proper sanitization or parameterization. The unsanitized value can alter the executed query and be used to disclose sensitive information from the database.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00415 36th percentileScored 2026-11-07
Fix Fixed IPFire (IPFire.org): 2.29 (Core Update 198)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IPFire.orgIPFirebefore 2.29 (Core Update 198)2.29 (Core Update 198)Patch availableCNA
  • IPFire VendorIPFire.org Affected before 2.29 (Core Update 198) Fixed in 2.29 (Core Update 198) Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*before 2.29VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*2.29 core_update183VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*2.29 core_update184VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*2.29 core_update185VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*2.29 core_update186VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*2.29 core_update187VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*2.29 core_update188VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*2.29 core_update189VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*2.29 core_update190VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*2.29 core_update191VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:* Versions before 2.29 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:* Versions 2.29 core_update183 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:* Versions 2.29 core_update184 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:* Versions 2.29 core_update185 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:* Versions 2.29 core_update186 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:* Versions 2.29 core_update187 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:* Versions 2.29 core_update188 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:* Versions 2.29 core_update189 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:* Versions 2.29 core_update190 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:* Versions 2.29 core_update191 Vulnerable ·IPFire.org
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*2.29 core_update192VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*2.29 core_update193VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*2.29 core_update194VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*2.29 core_update195VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*2.29 core_update196VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*2.29 core_update197VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:* Versions 2.29 core_update192 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:* Versions 2.29 core_update193 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:* Versions 2.29 core_update194 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:* Versions 2.29 core_update195 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:* Versions 2.29 core_update196 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:* Versions 2.29 core_update197 Vulnerable ·IPFire.org

Remediation

  • Fix · CNA IPFire (IPFire.org) Fixed in 2.29 (Core Update 198)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IPFire.org IPFire — ipfire.org/blog/ipfire-2-29-core-update-198-released

    18 records Highest priority Priority MEDIUM 2 MEDIUM, 16 LOW

    Other records, highest priority first

    • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report CreationPriority MEDIUM 54
    • TI-2025-24445 IPFire < v2.29 Command Injection via URL Filter BlacklistPriority MEDIUM 44
    • TI-2025-24442 IPFire < v2.29 Stored XSS via Dynamic DNS HostPriority LOW 31
    Show all 18 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34304
  2. 2026-10-03 Alias added: GHSA-2hwv-ff5w-xmw9

References

Patch 1

Advisory 1

  • TI-2021-12837 lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl… CVSS 3.1HIGH 8.8
  • TI-2017-07141 IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE… CVSS 3.0HIGH 8.8
  • TI-2025-32283 IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied… CVSS 3.1MEDIUM 6.1
  • TI-2025-32282 IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule… CVSS 3.1MEDIUM 5.4
  • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report Creation CVSS 4.0HIGH 8.7
  • TI-2018-11622 An authenticated command injection vulnerability exists in IPFire Firewall before 2.21… CVSS 3.1HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences