Directory Traversal Vulnerability in pfSense Snort Package
CVE-2025-34173
5.3MEDIUM
What is CVE-2025-34173?
A vulnerability exists in the pfSense CE Snort package where the iplist parameter is not adequately sanitized for directory traversal characters. This issue allows an authenticated attacker with 'WebCfg - Services: Snort package' permissions to determine if specific files exist on the server. While the contents of these files are protected, the ability to confirm their existence poses a security risk by enabling potential attackers to enumerate files within the system.
Affected Version(s)
pfSense CE 4.1.6_25
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Alex Williams (Pellera Technologies)