Read the docs
TI-2025-24439 Aliases CVE-2025-34306GHSA-mwgc-wqw6-8hcp

IPFire < v2.29 Stored XSS via Default IP Search Value

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the pienumber parameter when updating the default firewall IP search values. When a user updates these defaults, the application issues an HTTP POST request to /cgi-bin/logs.cgi/firewalllogip.dat with the default number of IPs in the pienumber parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected page.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00485 42nd percentileScored 2026-11-07
Fix Fixed IPFire (IPFire.org): 2.29 (Core Update 198)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IPFire.orgIPFirebefore 2.29 (Core Update 198)2.29 (Core Update 198)Patch availableCNA
  • IPFire VendorIPFire.org Affected before 2.29 (Core Update 198) Fixed in 2.29 (Core Update 198) Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*before 2.29VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*2.29 core_update183VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*2.29 core_update184VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*2.29 core_update185VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*2.29 core_update186VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*2.29 core_update187VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*2.29 core_update188VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*2.29 core_update189VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*2.29 core_update190VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*2.29 core_update191VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:* Versions before 2.29 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:* Versions 2.29 core_update183 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:* Versions 2.29 core_update184 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:* Versions 2.29 core_update185 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:* Versions 2.29 core_update186 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:* Versions 2.29 core_update187 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:* Versions 2.29 core_update188 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:* Versions 2.29 core_update189 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:* Versions 2.29 core_update190 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:* Versions 2.29 core_update191 Vulnerable ·IPFire.org
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*2.29 core_update192VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*2.29 core_update193VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*2.29 core_update194VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*2.29 core_update195VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*2.29 core_update196VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*2.29 core_update197VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:* Versions 2.29 core_update192 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:* Versions 2.29 core_update193 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:* Versions 2.29 core_update194 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:* Versions 2.29 core_update195 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:* Versions 2.29 core_update196 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:* Versions 2.29 core_update197 Vulnerable ·IPFire.org

Remediation

  • Fix · CNA IPFire (IPFire.org) Fixed in 2.29 (Core Update 198)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IPFire.org IPFire — ipfire.org/blog/ipfire-2-29-core-update-198-released

    18 records Highest priority Priority MEDIUM 2 MEDIUM, 16 LOW

    Other records, highest priority first

    • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report CreationPriority MEDIUM 54
    • TI-2025-24445 IPFire < v2.29 Command Injection via URL Filter BlacklistPriority MEDIUM 44
    • TI-2025-24442 IPFire < v2.29 Stored XSS via Dynamic DNS HostPriority LOW 31
    Show all 18 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34306
  2. 2026-10-03 Alias added: GHSA-mwgc-wqw6-8hcp

References

Patch 1

Advisory 1

  • TI-2021-12837 lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl… CVSS 3.1HIGH 8.8
  • TI-2017-07141 IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE… CVSS 3.0HIGH 8.8
  • TI-2025-32283 IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied… CVSS 3.1MEDIUM 6.1
  • TI-2025-32282 IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule… CVSS 3.1MEDIUM 5.4
  • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report Creation CVSS 4.0HIGH 8.7
  • TI-2018-11622 An authenticated command injection vulnerability exists in IPFire Firewall before 2.21… CVSS 3.1HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences