Read the docs
TI-2025-24442 Aliases CVE-2025-34309GHSA-2wmf-f2cc-qq97

IPFire < v2.29 Stored XSS via Dynamic DNS Host

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SERVICE, LOGIN, and PASSWORD parameters when creating or editing a Dynamic DNS host. When a new Dynamic DNS host is added, the application issues an HTTP POST request to /cgi-bin/ddns.cgi and saves the values of the LOGIN, PASSWORD, and SERVICE parameters. The SERVICE value is displayed after the host entry is created, and the LOGIN and PASSWORD values are displayed when that host entry is edited. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view or edit the affected Dynamic DNS entries.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05324 92nd percentileScored 2026-11-07
Fix Fixed IPFire (IPFire.org): 2.29 (Core Update 198)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IPFire.orgIPFirebefore 2.29 (Core Update 198)2.29 (Core Update 198)Patch availableCNA
  • IPFire VendorIPFire.org Affected before 2.29 (Core Update 198) Fixed in 2.29 (Core Update 198) Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*before 2.29VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*2.29 core_update183VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*2.29 core_update184VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*2.29 core_update185VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*2.29 core_update186VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*2.29 core_update187VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*2.29 core_update188VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*2.29 core_update189VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*2.29 core_update190VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*2.29 core_update191VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:* Versions before 2.29 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:* Versions 2.29 core_update183 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:* Versions 2.29 core_update184 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:* Versions 2.29 core_update185 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:* Versions 2.29 core_update186 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:* Versions 2.29 core_update187 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:* Versions 2.29 core_update188 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:* Versions 2.29 core_update189 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:* Versions 2.29 core_update190 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:* Versions 2.29 core_update191 Vulnerable ·IPFire.org
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*2.29 core_update192VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*2.29 core_update193VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*2.29 core_update194VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*2.29 core_update195VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*2.29 core_update196VulnerableIPFire.org
cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*2.29 core_update197VulnerableIPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:* Versions 2.29 core_update192 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:* Versions 2.29 core_update193 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:* Versions 2.29 core_update194 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:* Versions 2.29 core_update195 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:* Versions 2.29 core_update196 Vulnerable ·IPFire.org
  • cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:* Versions 2.29 core_update197 Vulnerable ·IPFire.org

Remediation

  • Fix · CNA IPFire (IPFire.org) Fixed in 2.29 (Core Update 198)

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    IPFire.org IPFire — ipfire.org/blog/ipfire-2-29-core-update-198-released

    18 records Highest priority Priority MEDIUM 2 MEDIUM, 16 LOW

    Other records, highest priority first

    • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report CreationPriority MEDIUM 54
    • TI-2025-24445 IPFire < v2.29 Command Injection via URL Filter BlacklistPriority MEDIUM 44
    • TI-2025-24437 IPFire < v2.29 SQL Injection via OpenVPN Connection LogsPriority LOW 31
    Show all 18 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34309
  2. 2026-10-03 Alias added: GHSA-2wmf-f2cc-qq97

References

Patch 1

Advisory 1

  • TI-2021-12837 lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl… CVSS 3.1HIGH 8.8
  • TI-2017-07141 IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE… CVSS 3.0HIGH 8.8
  • TI-2025-32283 IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied… CVSS 3.1MEDIUM 6.1
  • TI-2025-32282 IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule… CVSS 3.1MEDIUM 5.4
  • TI-2025-24444 IPFire < v2.29 Command Injection via Proxy Report Creation CVSS 4.0HIGH 8.7
  • TI-2018-11622 An authenticated command injection vulnerability exists in IPFire Firewall before 2.21… CVSS 3.1HIGH 8.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences