IPFire
CVE-2025-34315
MEDIUM
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated injection (PR:L) via network UI, requires a victim to view the page (UI:R), script escapes into another user's browser context (S:C) with low confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
1DescriptionCVE.org
IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the REMOTELOG_ADDR parameter when updating the remote syslog server address. When a user updates the Remote logging Syslog server, the application issues an HTTP POST request to /cgi-bin/logs.cgi/config.dat and the server address is provided in the REMOTELOG_ADDR parameter. The value of this parameter is stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected configuration page.
AnalysisAI
Stored cross-site scripting in IPFire (all releases prior to 2.29 Core Update 198) allows an authenticated user with access to the Remote Logging settings to inject arbitrary JavaScript through the REMOTELOG_ADDR parameter of the POST to /cgi-bin/logs.cgi/config.dat; the value is persisted and later rendered in the Syslog configuration page without encoding, so the script executes in the browser of any user who views it. Exploitation requires a prior authenticated session (CVSS vector PR:L), access to that specific admin settings page, and a second user subsequently opening the affected page (UI:P), which is why the independent assessment treats this as a genuine but low-severity, high-noise finding rather than an urgent priority. No public exploit code was identified at time of analysis and EPSS is low at 0.45% (37th percentile); the issue is not in CISA KEV. Vendor-released patch: IPFire 2.29 Core Update 198.
Technical ContextAI
IPFire is a Linux-based firewall/router distribution whose administration is performed through a Perl/CGI web interface served by the underlying web server. The flaw is a classic CWE-79 persistent (stored) cross-site scripting issue: when an operator saves the Remote Logging Syslog server address, the application POSTs to /cgi-bin/logs.cgi/config.dat with the address in the REMOTELOG_ADDR parameter, and that value is written into the configuration store without sanitization. It is later interpolated into the HTML of the logging configuration view without HTML-entity encoding or output escaping, so any markup or script tags in the stored value are interpreted by the viewer's browser in the origin of the IPFire admin UI. Because the sink is a config page rather than an error/echo endpoint, execution is deferred until a user loads that page, making this a passive, interaction-dependent XSS rather than immediate reflected execution. CPE data enumerates affected builds as ipfire:ipfire 2.29 with core_update183 through core_update191, plus a wildcard cpe:2.3:a:ipfire:ipfire:* entry indicating earlier Core Updates are also in scope; the fix landed in Core Update 198 (IPFire 2.29). The vulnerability class is well understood and the realistic impact is limited to script execution inside an authenticated admin session (the affected page is behind the admin login), consistent with the low confidentiality/integrity impact and scope change reflected in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector.
RemediationAI
Upgrade to IPFire 2.29 Core Update 198, the release in which the stored XSS in the Remote Logging configuration is fixed; installations on the 2.29 branch at Core Update 183 through 191 should update through the normal Pakfire update mechanism, and the change is described in the vendor announcement at https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released with tracking details at https://bugzilla.ipfire.org/show_bug.cgi?id=13890. If immediate patching is not possible, compensating controls should target the preconditions rather than the payload: restrict access to the IPFire web administration interface (TCP 444 by default on the firewall's management network) to a trusted management VLAN or VPN and block it from untrusted networks, which prevents both the injection step and the victim's page view but does not remediate the underlying missing output encoding and adds operational friction for remote administrators; alternatively, limit the number of accounts with permission to reach the Remote Logging / Syslog settings page so that only highly trusted operators can trigger injection, though this does not protect a higher-privileged viewer from a lower-privileged injector; and audit the stored remote syslog address field for unexpected characters after any untrusted user has had access to the configuration page, since a previously stored payload continues to render until it is cleared or the system is updated. No public exploit code was identified at time of analysis and EPSS is low (0.45%, 37th percentile), so scheduling the update within a normal maintenance window is reasonable for most deployments.
IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a
lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. Ra
An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. Ra
IPFire 2.21 Core Update 127 contains multiple stored cross-site scripting vulnerabilities in the extrahd.cgi script that
IPFire 2.21 Core Update 127 contains multiple cross-site scripting vulnerabilities in the ovpnmain.cgi script that allow
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the hosts.cgi script tha
IPFire 2.21 Core Update 127 contains a reflected cross-site scripting vulnerability in the updatexlrator.cgi script that
IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script t
Command injection in the IPFire URL filter allows an authenticated administrator to execute arbitrary shell commands as
Authenticated command injection in the IPFire firewall distribution prior to 2.29 (Core Update 198) lets a low-privilege
Stored cross-site scripting in the IPFire firewall distribution (versions before 2.29 Core Update 198) lets an authentic
Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today