CVE-2025-34182

UNKNOWN 0.0

Deciso OPNsense < 25.7.4 /interfaces_ppps_edit.php ptpid Stored XSS

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-related characters/strings. This value is directly displayed when visiting the page/interfaces_assign.php, which can result in stored cross-site scripting. The attacker must be authenticated with at-least "Interfaces: PPPs: Edit" permission. This vulnerability has been addressed by the vendor in the product release notes as "ui: legacy_html_escape_form_data() was not escaping keys only data elements."

CWE	CWE-79
Vendor	deciso
Product	opnsense
Published	Oct 1, 2025
Last Updated	Mar 23, 2026

Stay Ahead of the Next One

Get instant alerts for deciso opnsense

Be the first to know when new unknown vulnerabilities affecting deciso opnsense are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Deciso / OPNsense

* < 25.7.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

docs.opnsense.org: https://docs.opnsense.org/releases/CE_25.7.html#september-30-2025 vulncheck.com: https://www.vulncheck.com/advisories/decisio-opnsense-stored-xss

Credits

Alex Williams from Pellera Technologies