CVE-2025-34182 | BDVDB-2026-296252 Detail

Description#

In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements."

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-01Record published in the CVE List.
2. Version 22026-05-15Most recent update recorded in the CVE List.