CVE-2025-34178 is a CWE-79 improper neutralization of input vulnerability in Netgate pfSense CE 7.0.8_2. The issue occurs because the policy_name parameter in /suricata/suricata_app_parsers.php is directly output without sanitization of HTML-related characters, leading to stored cross-site scripting. Exploitation requires the attacker to be authenticated with at least 'WebCfg - Services: suricata package' permissions. No known exploits are reported in the wild, and no official patch or remediation is currently documented.

Successful exploitation allows an authenticated user with specific Suricata service permissions to inject malicious scripts that are stored and executed in the context of the web interface. This can lead to unauthorized actions performed by the victim's browser, potentially compromising the integrity of the management interface or stealing session information. The vulnerability does not require elevated privileges beyond the stated permissions and does not affect confidentiality or availability directly.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Suricata service configuration to trusted users only. Monitor for updates from Netgate regarding an official fix or temporary workaround. Avoid granting 'WebCfg - Services: suricata package' permissions to untrusted users.