Is CVE-2025-34173 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-34173 being exploited in the wild.

How severe is CVE-2025-34173?

Medium severity, with a CVSS score of 4.3, published 9 September 2025.

Which products and versions are affected?

Netgate Pfsense Ce up to (excluding) 2.8.0; Netgate Pfsense Plus 25.07, 25.07.1; Netgate Snort package <= 4.1.6_25.

Is there a fix for CVE-2025-34173?

A patch was published on 2025-09-09: Fix committed to FreeBSD-ports repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-34173 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-34173?

Check whether you run Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Snort package or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-34173: Netgate pfSense Snort package directory traversal in snort_ip_reputation.php

Q: Is there a fix for CVE-2025-34173?

A patch was published on 2025-09-09: Fix committed to FreeBSD-ports repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-34173 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-34173?

Check whether you run Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Snort package or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-34173 · Severity: medium · CVSS 4.3 · Published 2025-09-09

A vulnerability exists in the Snort package for pfSense, a popular open-source firewall and routing platform. An authenticated user with access to Snort service settings can determine whether specific files exist on the underlying system, even if they shouldn't have access to those files. While the attacker cannot read the contents of the files, this information could be used to map out the system's configuration or identify other installed software, potentially aiding in more complex future attacks.

Technologies: Netgate Pfsense Ce, Netgate Pfsense Plus, Pfsense. Vendors: Netgate, Pfsense.

Quick answers

Is CVE-2025-34173 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-34173 being exploited in the wild.
How severe is CVE-2025-34173?: Medium severity, with a CVSS score of 4.3, published 9 September 2025.
Which products and versions are affected?: Netgate Pfsense Ce up to (excluding) 2.8.0; Netgate Pfsense Plus 25.07, 25.07.1; Netgate Snort package <= 4.1.6_25.
Is there a fix for CVE-2025-34173?: A patch was published on 2025-09-09: Fix committed to FreeBSD-ports repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-34173 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-34173?: Check whether you run Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Snort package or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in /usr/local/www/snort/snort_ip_reputation.php within the Snort package for pfSense. The 'iplist' parameter is used in a file existence check without proper sanitization of directory traversal sequences (e.g., ../). While the application does not return the file contents, the boolean response indicating whether a file exists allows an authenticated attacker with 'WebCfg - Services: Snort package' permissions to perform local file enumeration. The issue was addressed by restricting file checks to the designated IP reputation directory.

Affected products

Netgate pfSense CE up to (excluding) 2.8.0
Netgate pfSense Plus 25.07, 25.07.1
Netgate Snort package <= 4.1.6_25

Timeline

2025-09-09: advisory: Initial disclosure by VulnCheck
2025-09-09: patched: Fix committed to FreeBSD-ports repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.