Netgate pfSense CE 2.3.2_7 Status Traffic Totals Page status_traffic_totals.php start-day cross site scripting

Summaryinfo

A vulnerability was found in Netgate pfSense CE 2.3.2_7. It has been classified as problematic. This issue affects some unknown processing of the file /usr/local/www/status_traffic_totals.php of the component Status Traffic Totals Page. Performing a manipulation of the argument start-day results in cross site scripting. This vulnerability is cataloged as CVE-2025-34174. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability was found in Netgate pfSense CE 2.3.2_7. It has been classified as problematic. This affects an unknown code block of the file /usr/local/www/status_traffic_totals.php of the component Status Traffic Totals Page. The manipulation of the argument start-day with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:

In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.

The weakness was shared by Alex Williams as 16413. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-34174 since 04/15/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

By approaching the search of inurl:usr/local/www/status_traffic_totals.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 9e412edf62113303c36c7f7d5a48b0a3fb0be893 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Firewall Software

Vendor

• Netgate

Name

• pfSense CE

Version

• 2.3.2_7

License

• open-source

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion