Is CVE-2025-34175 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-34175 being exploited in the wild.

How severe is CVE-2025-34175?

Medium severity, with a CVSS score of 6.1, published 9 September 2025.

Which products and versions are affected?

Netgate Pfsense Ce < 2.8.0; Netgate Pfsense Plus < 25.07.0; Netgate Suricata package for pfSense <= 7.0.8_2.

Is there a fix for CVE-2025-34175?

A patch was published on 2025-09-09: Fix committed to FreeBSD-ports repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-34175 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-34175?

Check whether you run Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Suricata package for pfSense or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-34175: Netgate pfSense Suricata reflected XSS in suricata_filecheck.php

Q: Which products and versions are affected?

Netgate Pfsense Ce < 2.8.0; Netgate Pfsense Plus < 25.07.0; Netgate Suricata package for pfSense <= 7.0.8_2.

Q: Is there a fix for CVE-2025-34175?

A patch was published on 2025-09-09: Fix committed to FreeBSD-ports repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-34175 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-34175?

Check whether you run Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Suricata package for pfSense or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-34175 · Severity: medium · CVSS 6.1 · Published 2025-09-09

A security vulnerability exists in the Suricata intrusion detection package for pfSense firewalls. An attacker could trick an authenticated administrator into clicking a malicious link, allowing the attacker to execute unauthorized scripts within the administrator's browser session. This could lead to unauthorized configuration changes or the theft of sensitive session information.

Technologies: Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Suricata package for pfSense, Pfsense. Vendors: Netgate, Pfsense.

Quick answers

Is CVE-2025-34175 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-34175 being exploited in the wild.
How severe is CVE-2025-34175?: Medium severity, with a CVSS score of 6.1, published 9 September 2025.
Which products and versions are affected?: Netgate Pfsense Ce < 2.8.0; Netgate Pfsense Plus < 25.07.0; Netgate Suricata package for pfSense <= 7.0.8_2.
Is there a fix for CVE-2025-34175?: A patch was published on 2025-09-09: Fix committed to FreeBSD-ports repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-34175 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-34175?: Check whether you run Netgate Pfsense Ce, Netgate Pfsense Plus, Netgate Suricata package for pfSense or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the Suricata package for pfSense (CE and Plus) within the 'suricata_filecheck.php' component. The root cause is the failure to sanitize the 'filehash' GET parameter before rendering it in the HTML response. An unauthenticated remote attacker can exploit this by inducing an authenticated user to visit a specially crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking or unauthorized administrative actions. The issue is resolved in Suricata package versions following 7.0.8_2, available for pfSense CE 2.8.0 and pfSense Plus 25.07.0 and later.

Affected products

Netgate pfSense CE < 2.8.0
Netgate pfSense Plus < 25.07.0
Netgate Suricata package for pfSense <= 7.0.8_2

Timeline

2025-09-09: disclosed
2025-09-09: patched: Fix committed to FreeBSD-ports repository
2025-09-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.