CVE-2025-34174: pfSense Traffic Totals XSS Vulnerability

CVE-2025-34174 Overview

CVE-2025-34174 is a stored cross-site scripting (XSS) vulnerability in pfSense Community Edition. The flaw resides in /usr/local/www/status_traffic_totals.php, where the start-day parameter is written to configuration without numeric validation or HTML sanitization. When any user visits the Status Traffic Totals page, the injected payload executes in their browser context. An attacker must be authenticated with the WebCfg - Status: Traffic Totals permission to plant the payload. The vulnerability is tracked as [CWE-79] and was addressed in the pfSense-pkg-Status_Traffic_Totals package version 2.3.3.

Critical Impact
Authenticated attackers can persistently inject JavaScript into the pfSense web interface, enabling session hijacking, credential theft, and firewall configuration tampering against administrators.

Affected Products

pfSense Community Edition (CE)
pfSense-pkg-Status_Traffic_Totals package versions prior to 2.3.3
pfSense CE installations with the Status Traffic Totals package installed

Discovery Timeline

2025-09-09 - CVE-2025-34174 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34174

Vulnerability Analysis

The vulnerability exists in the settings-save handler of status_traffic_totals.php. The page accepts POST parameters that define default display values for the Status Traffic Totals interface. The start-day parameter is written directly into the pfSense configuration store using config_set_path() and later rendered into an HTML input element without escaping.

Because the saved value becomes the default view for all subsequent visitors, the payload triggers whenever another authenticated user, including administrators, loads the page. Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the pfSense web UI. This exposes session cookies, CSRF tokens, and any firewall action available to the victim.

Root Cause

The pre-patch code contained an explicit //TODO clean inputs comment above the block that persisted start-day, time-period, interfaces, graph-type, invert, and cumulative. None of these values were validated against an allowlist or sanitized before storage. The start-day field, expected to hold a numeric day of the month, accepted arbitrary strings containing HTML and JavaScript.

Attack Vector

An attacker with the WebCfg - Status: Traffic Totals permission submits a crafted POST request to status_traffic_totals.php with the defaults flag set and a malicious start-day value. The payload persists in the pfSense configuration. Any user visiting the Status Traffic Totals page then executes the injected script under the pfSense origin.

php

// Vendor patch replaces unsanitized assignment with allowlist validation
// Source: https://github.com/pfsense/FreeBSD-ports/commit/9e412edf62113303c36c7f7d5a48b0a3fb0be893
if ($_POST['defaults']) {
    unset($input_errors);

    if (in_array($_POST['time-period'], ['hour', 'day', 'month', 'top'])) {
        $timePeriod = $_POST['time-period'];
    } else {
        $input_errors[] = gettext("Invalid Time Period.");
    }

    if (is_array($_POST['interfaces']) &&
        // additional validation follows for each stored field
}

The patch also bumps PORTVERSION from 2.3.2 to 2.3.3 in the package Makefile.

Detection Methods for CVE-2025-34174

Indicators of Compromise

Non-numeric or HTML-bearing values stored under installedpackages/traffictotals/config/0/startday in config.xml.
Unexpected <script>, onerror=, or javascript: strings appearing in the Status Traffic Totals page source.
Web server access logs showing POST requests to /status_traffic_totals.php containing the defaults parameter from non-administrator accounts.

Detection Strategies

Audit the pfSense config.xml for the traffictotals stanza and verify each stored field matches its expected type and allowlist.
Monitor pfSense webConfigurator logs for accounts with only the Status: Traffic Totals permission submitting settings changes.
Compare the installed pfSense-pkg-Status_Traffic_Totals package version against 2.3.3 across all firewalls.

Monitoring Recommendations

Forward pfSense webConfigurator and system logs to a centralized SIEM for retrospective XSS pattern hunting.
Alert on configuration changes affecting installedpackages/traffictotals outside of approved change windows.
Track anomalous administrator session activity, such as unexpected outbound requests originating from browsers with active pfSense sessions.

How to Mitigate CVE-2025-34174

Immediate Actions Required

Upgrade the pfSense-pkg-Status_Traffic_Totals package to version 2.3.3 or later on every pfSense CE instance.
Review current stored defaults on the Status Traffic Totals page and reset any values that contain non-numeric or HTML content.
Restrict the WebCfg - Status: Traffic Totals permission to trusted administrative accounts only.

Patch Information

The fix is delivered in the pfSense package commit 9e412ed, which raises PORTVERSION to 2.3.3 and replaces unvalidated $_POST assignments with allowlist checks in status_traffic_totals.php. Additional context is available in the pfSense Issue Tracker #16413 and the VulnCheck Advisory for pfSense.

Workarounds

Remove or disable the Status Traffic Totals package until the upgrade to 2.3.3 can be applied.
Revoke the WebCfg - Status: Traffic Totals privilege from non-administrative users to remove the authenticated attack surface.
Restrict access to the pfSense webConfigurator to a management VLAN and enforce multi-factor authentication for administrator logins.

bash

# Update the vulnerable package on pfSense CE
pkg update
pkg upgrade pfSense-pkg-Status_Traffic_Totals

# Verify the installed version is 2.3.3 or later
pkg info pfSense-pkg-Status_Traffic_Totals | grep Version