The vulnerability CVE-2025-34172 in Netgate pfSense CE version 0.63_10 is a reflected XSS issue due to improper neutralization of input in the haproxy_stats.php page. Specifically, the showsticktablecontent parameter is read from HTTP GET requests and directly displayed without proper sanitization, enabling an attacker to inject malicious scripts that execute in the context of an authenticated user's browser session.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of an authenticated user's session, potentially leading to session hijacking or other actions performed with the user's privileges. However, exploitation requires the victim to be authenticated, and the overall impact is limited by the medium CVSS score and the low complexity of attack with no privileges required beyond authentication.

No official patch or fix information is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should limit access to the affected page to trusted users and consider applying web application firewall rules to detect and block suspicious input in the showsticktablecontent parameter.