Stored Cross-Site Scripting in Deciso OPNsense
CVE-2025-34182

5.1MEDIUM

Key Information:

Vendor

Deciso

Status
Opnsense
Vendor
CVE Published:
1 October 2025

What is CVE-2025-34182?

In Deciso OPNsense versions before 25.7.4, a vulnerability exists when creating 'Interfaces: Devices: Point-to-Point' entries. The parameter 'ptpid' is not properly sanitized, allowing an attacker with 'Interfaces: PPPs: Edit' permission to inject HTML-related characters into the system. This lack of sanitization can lead to stored cross-site scripting (XSS) when the data is displayed on the page. The issue has been addressed in the latest product release, enhancing the security of the web interface.

Affected Version(s)

OPNsense * < 25.7.4

References

https://docs.opnsense.org/releases/CE_25.7.html#september...
vendor-advisorypatch
https://www.vulncheck.com/advisories/decisio-opnsense-sto...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
JSON
.
CVE-2025-34182 : Stored Cross-Site Scripting in Deciso OPNsense