CVE-2025-34310

{"id": "CVE-2025-34310", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-34310", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-29T18:12:19.587131Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "IPFire.org", "modules": ["/cgi-bin/qos.cgi"], "product": "IPFire", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29 (Core Update 198)", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-28T15:16:11.293", "references": [{"url": "https://bugzilla.ipfire.org/show_bug.cgi?id=13883", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.ipfire.org/blog/ipfire-2-29-core-update-198-released", "tags": ["Release Notes"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/ipfire-stored-xss-via-quality-of-service-settings", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "IPFire versions prior to 2.29 (Core Update 198) contain\u00a0a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters when updating Quality of Service (QoS) settings. When a user updates speeds or classes, the application issues an HTTP POST request to /cgi-bin/qos.cgi and the values for incoming/outgoing speeds and default classes are provided in the INC_SPD, OUT_SPD, DEFCLASS_INC, and DEFCLASS_OUT parameters. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view the affected QoS entries."}, {"lang": "es", "value": "Las versiones de IPFire anteriores a 2.29 (Core Update 198) contienen una vulnerabilidad de cross-site scripting (XSS) almacenado que permite a un atacante autenticado inyectar c\u00f3digo JavaScript arbitrario a trav\u00e9s de los par\u00e1metros INC_SPD, OUT_SPD, DEFCLASS_INC y DEFCLASS_OUT al actualizar la configuraci\u00f3n de Calidad de Servicio (QoS). Cuando un usuario actualiza velocidades o clases, la aplicaci\u00f3n emite una solicitud HTTP POST a /cgi-bin/qos.cgi y los valores para las velocidades de entrada/salida y las clases predeterminadas se proporcionan en los par\u00e1metros INC_SPD, OUT_SPD, DEFCLASS_INC y DEFCLASS_OUT. Los valores de estos par\u00e1metros se almacenan y luego se renderizan en la interfaz web sin la sanitizaci\u00f3n o codificaci\u00f3n adecuadas, lo que permite que los scripts inyectados se ejecuten en el contexto de otros usuarios que ven las entradas de QoS afectadas."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ipfire:ipfire:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A0A85D3-A192-4FD9-9510-99D85BCF334A", "versionEndExcluding": "2.29"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update183:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A39350F9-D6D9-49A5-88BC-C5489AA6038C"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update184:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDDC0CEB-073B-41A0-8A52-4DAAAD77AA6D"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update185:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "745640B9-2180-48C3-82CC-D6E73AAF95D5"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update186:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08006D41-7288-4333-83FE-B6FD7CD5C779"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update187:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15EE4FEE-62AB-4172-B898-19DE6F50B7AC"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update188:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B0ECE9B-DD45-40E1-842A-0B0B1786187E"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update189:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B9BDB00-A750-4053-8812-5A3854042CB4"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update190:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F654D7-CC82-4428-BBEF-1110CAE75597"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update191:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFCC61A9-AF1B-4F8A-98D2-FB7854AF0EF6"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update192:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A66DC97-E88F-455E-B688-88BCC95E861B"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update193:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DDF56682-47E8-436F-B5FE-55A8B525D699"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update194:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4ADE9ED-675A-4577-AF4A-047B4D7D8E2D"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update195:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FA0F87A-3926-4B10-97C8-12EBFD9454D8"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update196:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0E2F1488-B8FA-4BFF-81B9-308E0C462B47"}, {"criteria": "cpe:2.3:a:ipfire:ipfire:2.29:core_update197:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3480B74D-D516-4A8C-AAA3-C7990FEA345D"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}