CVE-2025-34182: Deciso OPNsense Stored XSS Vulnerability

CVE-2025-34182 Overview

CVE-2025-34182 is a stored cross-site scripting (XSS) vulnerability in Deciso OPNsense before version 25.7.4. The flaw resides in the Interfaces: Devices: Point-to-Point configuration, where the ptpid parameter is not sanitized of HTML-related characters. The unsanitized value is rendered directly on interfaces_assign.php, enabling script injection into the administrative interface. An authenticated attacker holding Interfaces: PPPs: Edit permission can plant a persistent payload that executes against any user who browses the affected page. The vendor addressed the issue in the 25.7.4 release notes, noting that legacy_html_escape_form_data() was escaping keys but not data elements.

Critical Impact
An authenticated low-privileged user can inject persistent JavaScript into the OPNsense firewall administration interface, hijacking sessions of higher-privileged administrators who load the affected page.

Affected Products

Deciso OPNsense Community Edition versions prior to 25.7.4
Deciso OPNsense Business Edition builds sharing the pre-25.7.4 UI codebase
Any OPNsense deployment with users holding Interfaces: PPPs: Edit permission

Discovery Timeline

2025-10-01 - CVE-2025-34182 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-34182

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in the OPNsense web administration interface. When an administrator creates a Point-to-Point interface entry, the ptpid field accepts arbitrary input without HTML sanitization. The value is persisted in the configuration and later reflected into the rendered HTML of interfaces_assign.php. Any browser loading that page interprets the injected markup, executing attacker-controlled JavaScript inside the authenticated session.

Exploitation requires authentication and the Interfaces: PPPs: Edit permission. However, OPNsense environments often delegate interface management to operators who do not hold full root privileges. A payload planted by such an operator triggers against higher-privileged administrators who visit the assignment page, enabling privilege escalation through session theft, CSRF-based configuration changes, or firmware manipulation.

Root Cause

The vendor identified the root cause in the release notes: the helper function legacy_html_escape_form_data() was escaping dictionary keys but not the associated data values. As a result, user-controlled values passed through this helper reached the output layer with HTML metacharacters intact. The ptpid field in the Point-to-Point configuration flow is one path that relied on this helper.

Attack Vector

The attack vector is network-based and requires authentication plus user interaction from a victim administrator. An attacker with Interfaces: PPPs: Edit rights submits a crafted ptpid value containing an HTML script payload through the Point-to-Point creation form. The payload is stored in the OPNsense configuration. When any authenticated user navigates to interfaces_assign.php, the browser renders and executes the stored script within the OPNsense origin, granting the attacker access to session cookies, CSRF tokens, and the full administrative API.

The vulnerability manifests server-side in the form-handling helper. See the VulnCheck Security Advisory and the OPNsense Release Notes for additional technical detail.

Detection Methods for CVE-2025-34182

Indicators of Compromise

Point-to-Point interface entries whose ptpid field contains HTML tags, angle brackets, or JavaScript event handlers such as onerror, onload, or <script>.
Unexpected outbound HTTP requests from administrator browsers to attacker-controlled domains shortly after loading interfaces_assign.php.
Audit log entries showing creation or modification of Point-to-Point interfaces by low-privileged accounts followed by configuration changes from administrator accounts.

Detection Strategies

Inspect the OPNsense config.xml for Point-to-Point entries and flag any ptpid value containing characters outside the expected alphanumeric set.
Deploy web application monitoring on the OPNsense management interface to alert on responses containing script tags inside interface configuration pages.
Correlate authenticated session activity: a low-privileged PPP editor followed by sensitive actions from an administrator session on the same host is a strong indicator.

Monitoring Recommendations

Forward OPNsense audit and web server logs to a centralized SIEM and alert on edits to Point-to-Point configurations.
Monitor administrator session cookies for use from unexpected source IPs, which may indicate stolen session material.
Review all accounts holding the Interfaces: PPPs: Edit permission on a recurring basis and remove unneeded grants.

How to Mitigate CVE-2025-34182

Immediate Actions Required

Upgrade OPNsense to version 25.7.4 or later, which contains the fix to legacy_html_escape_form_data().
Audit existing Point-to-Point interface entries and remove any ptpid value containing HTML metacharacters before upgrading.
Restrict the Interfaces: PPPs: Edit permission to trusted administrators until patching is complete.

Patch Information

Deciso released OPNsense 25.7.4 on September 30, 2025. The release notes describe the fix as ui: legacy_html_escape_form_data() was not escaping keys only data elements. Apply the update through the built-in firmware update mechanism or by consulting the OPNsense Release Notes.

Workarounds

Remove the Interfaces: PPPs: Edit permission from all non-administrative users as a temporary control until the patch is applied.
Access the OPNsense web UI from a dedicated management browser profile to limit the blast radius of a successful XSS payload.
Enforce a strict Content Security Policy at a reverse proxy fronting the OPNsense administration interface to block inline script execution.

bash

# Upgrade OPNsense to the patched release from the console
opnsense-update -ub
opnsense-update -kr
reboot