CVE-2025-34305: IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function…

PriorityP430medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.45%

36.1th percentile

IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function (/var/ipfire/header.pl) that fails to apply HTML-entity encoding to user input. When an authenticated user submits data to affected endpoints - for example, POST /cgi-bin/wakeonlan.cgi (CLIENT_COMMENT), /cgi-bin/dhcp.cgi (ADVOPT_DATA, FIX_REMARK, FIX_FILENAME, FIX_ROOTPATH), /cgi-bin/connscheduler.cgi (ACTION_COMMENT), /cgi-bin/dnsforward.cgi (REMARK), /cgi-bin/vpnmain.cgi (REMARK), or /cgi-bin/dns.cgi (REMARK) - the application calls escape() and HTML::Entities::encode_entities() but never assigns the sanitized result back to the output variable. The original unsanitized value is therefore stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected entries.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ipfire.org	ipfire	< 2.29 (Core Update 198)	2.29 (Core Update 198)
ipfire	ipfire	< 2.29	2.29
ipfire	ipfire	—	—

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)

suricata·2025-10-30·CVSS 5.1

CVE-2025-34305 [MEDIUM] ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305) ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:22; content:"/cgi-bin/wakeonlan.cgi"; fast_pattern; http.request_body; content:"CLIENT_COMMENT|3d|"; pcre:"/^.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])?/Ri"; reference:url,bugzilla.ipfire.org/attachment.cgi?id=1663; reference:cve,2025-34305; classtype:web-application-attack; sid:2065574; rev:1; metadata:affected_product IPFire, attack_

Suricata

ET WEB_SPECIFIC_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)

suricata·2025-10-30·CVSS 5.1

CVE-2025-34305 [MEDIUM] ET WEB_SPECIFIC_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) ET WEB_SPECIFIC_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:20; content:"/cgi-bin/vpnmain.cgi"; fast_pattern; http.request_body; content:"REMARK|3d|"; pcre:"/^.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])?/Ri"; reference:url,bugzilla.ipfire.org/attachment.cgi?id=1663; reference:cve,2025-34305; classtype:web-application-attack; sid:2065578; rev:1; metadata:affected_product IPFire, attack_target Networking_Equipment, tls

Suricata

ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)

suricata·2025-10-30·CVSS 5.1

CVE-2025-34305 [MEDIUM] ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:23; content:"/cgi-bin/dnsforward.cgi"; fast_pattern; http.request_body; content:"REMARK|3d|"; pcre:"/^.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])?/Ri"; reference:url,bugzilla.ipfire.org/attachment.cgi?id=1663; reference:cve,2025-34305; classtype:web-application-attack; sid:2065577; rev:1; metadata:affected_product IPFire, attack_target Networking_Equip

Suricata

ET WEB_SPECIFIC_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305)

suricata·2025-10-30·CVSS 5.1

CVE-2025-34305 [MEDIUM] ET WEB_SPECIFIC_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305) ET WEB_SPECIFIC_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:17; content:"/cgi-bin/dhcp.cgi"; fast_pattern; http.request_body; pcre:"/(?:ADVOPT_DATA|FIX_(?:REMARK|ROOTPATH|FILENAME))\x3d.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])?/i"; reference:url,bugzilla.ipfire.org/attachment.cgi?id=1663; reference:cve,2025-34305; classtype:web-application-attack; sid:2065575; rev:1; metadata:affected_product IPFire, attack_target

Suricata

ET WEB_SPECIFIC_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)

suricata·2025-10-30·CVSS 5.1

CVE-2025-34305 [MEDIUM] ET WEB_SPECIFIC_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) ET WEB_SPECIFIC_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:16; content:"/cgi-bin/dns.cgi"; fast_pattern; http.request_body; content:"REMARK|3d|"; pcre:"/^.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])?/Ri"; reference:url,bugzilla.ipfire.org/attachment.cgi?id=1663; reference:cve,2025-34305; classtype:web-application-attack; sid:2065579; rev:1; metadata:affected_product IPFire, attack_target Networking_Equipment, tls_state plain

Suricata

ET WEB_SPECIFIC_APPS IPFire connscheduler.cgi ACTION_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)

suricata·2025-10-30·CVSS 5.1

CVE-2025-34305 [MEDIUM] ET WEB_SPECIFIC_APPS IPFire connscheduler.cgi ACTION_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305) ET WEB_SPECIFIC_APPS IPFire connscheduler.cgi ACTION_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305) Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS IPFire connscheduler.cgi ACTION_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:26; content:"/cgi-bin/connscheduler.cgi"; fast_pattern; http.request_body; content:"ACTION_COMMENT|3d|"; pcre:"/^.*(?:on(?:(?:error)|(?:s(?:elec|ubmi)|rese)t|d(?:blclick|ragdrop)|(?:mouse|key)[a-z]|c(?:hange|lick)|(?:un)?load|focus|blur)|s(?:cript|tyle))(?:=|%3[dD])?/Ri"; reference:url,bugzilla.ipfire.org/attachment.cgi?id=1663; reference:cve,2025-34305; classtype:web-application-attack; sid:2065576; rev:1; metadata:attack_target Networki