IPFire CVE-2025-34316

Upgrade to IPFire 2.29 Core Update 198 or later, the vendor-released fix for CVE-2025-34316; the update is distributed through the normal IPFire package system (Pakfire), and the advisory and release notes are at https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released and https://bugzilla.ipfire.org/show_bug.cgi?id=13891. Because the injected script persists in stored configuration, patching alone does not remove an existing payload: after upgrading, open the mail server configuration page, clear and re-save the mail username and password fields (or re-enter the correct credentials from a known-good source) so any previously stored JavaScript is overwritten, and review the mail settings and any log/notification mailboxes for evidence of tampering. As a compensating control on systems that cannot be updated immediately, restrict access to the web management interface (TCP 444/81 or the configured admin port) to a trusted management VLAN or VPN and avoid exposing it to the internet, which removes the network reachability required by the AV:N vector; the trade-off is loss of remote administration. Note that the practical risk is limited: exploitation requires an authenticated session on the admin UI plus a second user viewing the affected page, the impact is confined to the victim's browser session, and there is no public exploit code and only a 0.45% EPSS score, so remediation should be scheduled rather than treated as an emergency.