CVE-2025-34175: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in Netgate pfSense CE
In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.
AI Analysis
Technical Summary
This vulnerability in pfSense CE 7.0.8_2 involves improper neutralization of input during web page generation (CWE-79). Specifically, the filehash parameter in suricata_filecheck.php is directly reflected in the web page without sanitizing HTML-related characters, enabling reflected cross-site scripting if the victim is authenticated. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, low impact on confidentiality, and limited scope.
Potential Impact
An attacker can exploit this vulnerability to perform reflected XSS attacks against authenticated users of pfSense CE 7.0.8_2. This could lead to the execution of arbitrary scripts in the context of the victim's browser session, potentially allowing session hijacking or other malicious actions limited by the scope and impact ratings.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, limiting access to the affected interface to trusted users and avoiding clicking on untrusted links that include crafted filehash parameters may reduce risk.
CVE-2025-34175: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in Netgate pfSense CE
Description
In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.
CVSS v4.0
Score 5.1medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in pfSense CE 7.0.8_2 involves improper neutralization of input during web page generation (CWE-79). Specifically, the filehash parameter in suricata_filecheck.php is directly reflected in the web page without sanitizing HTML-related characters, enabling reflected cross-site scripting if the victim is authenticated. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, user interaction required, low impact on confidentiality, and limited scope.
Potential Impact
An attacker can exploit this vulnerability to perform reflected XSS attacks against authenticated users of pfSense CE 7.0.8_2. This could lead to the execution of arbitrary scripts in the context of the victim's browser session, potentially allowing session hijacking or other malicious actions limited by the scope and impact ratings.
Mitigation Recommendations
No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, limiting access to the affected interface to trusted users and avoiding clicking on untrusted links that include crafted filehash parameters may reduce risk.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2025-04-15T19:15:22.567Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 68c089dc075fc5f733c91a33
Added to database: 09/09/2025, 20:11:08 UTC
Last enriched: 07/15/2026, 09:52:11 UTC
Last updated: 09/10/2026, 19:36:50 UTC
Views: 159
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.