How to fix CVE-2025-34182?

Within 30 days: Identify affected systems running Deciso OPNsense and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Is PHP affected by CVE-2025-34182?

Organizations using Deciso OPNsense should be aware of moderate risk from CVE-2025-34182, a cross-site scripting vulnerability rated CVSS 5.1. Attackers could inject scripts to steal sessions or perform actions as authenticated users.

CVE-2025-34182

EUVD-2025-32711 MEDIUM

2025-10-01 [email protected]

PHP XSS

5.1

CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Lifecycle Timeline

patch_available

Apr 16, 2026 - 05:29 EUVD

25.7.4

Analysis Generated

Mar 13, 2026 - 18:18 vuln.today

EUVD ID Assigned

Mar 13, 2026 - 18:18 euvd

EUVD-2025-32711

CVE Published

Oct 01, 2025 - 17:15 nvd

MEDIUM 5.1

DescriptionNVD

In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements."

AnalysisAI

Technical ContextAI

Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.

RemediationAI

Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.

CVE-2025-34182 vulnerability details – vuln.today

Back