CVE-2025-34302: IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that

Q: How do I fix CVE-2025-34302?

ipfire: upgrade to 2.29. Exact commands for each OS are on this page.

Q: Is CVE-2025-34302 being exploited?

CVE-2025-34302 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-34302 affect?

CVE-2025-34302 affects ipfire. Severity is medium (CVSS 5.4). IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When

Q: How urgent is CVE-2025-34302?

Priority 29/100. No elevated risk signals yet.

Routine

MEDIUM 5.4UPGRADE

CVE-2025-34302 is a medium-severity flaw (CVSS 5.4) affecting ipfire. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST request with the ACTION parameter set to saveservice, and the protocol type is specified in the PROT parameter. The value of this parameter is stored

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.5% (top 58%)
CISA exploited list	No
Weakness	CWE-79
Published	2025-10-28
Last modified	2026-10-19

Publisher (CNA): VulnCheck · Vendor: ipfire

Last updated 2026-10-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-10-28 15:16 UTCPublished CVE record published
2026-10-19 13:10 UTCUpdated Record last modified

ipfire ipfire UPGRADE

Affected: < 2.29 · 2.29 core_update183 · 2.29 core_update184 · 2.29 core_update185 · 2.29 core_update186 · 2.29 core_update187 · 2.29 core_update188 · 2.29 core_update189

Fixed in: 2.29

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy ipfire || rpm -q ipfire || ipfire --version

2. UPGRADE to 2.29 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade ipfire

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade ipfire

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-34302?

ipfire: upgrade to 2.29. Exact commands for each OS are on this page.

Is CVE-2025-34302 being exploited?

CVE-2025-34302 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-34302 affect?

CVE-2025-34302 affects ipfire. Severity is medium (CVSS 5.4). IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When

How urgent is CVE-2025-34302?

Priority 29/100. No elevated risk signals yet.

Related CVEs

CVE-2025-34301 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
CVE-2025-34309 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
CVE-2025-34304 MEDIUM 6.5 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a SQL injection vulnerability that allows an authentic
CVE-2025-34303 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that
CVE-2025-34305 MEDIUM 5.4 UPGRADE IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabili

References

← Back to latest CVEs