XSS in Ipfire

CVE-2025-50975

IPFire 2.29 web-based firewall interface (firewall.cgi) fails to sanitize several rule parameters such as PROT, SRC_PORT, TGT_PORT, dnatport, key, ruleremark, src_addr, std_net_tgt, and tgt_addr, allowing an authenticated administrator to inject persistent JavaScript. This stored XSS payload is executed whenever another admin views the firewall rules page, enabling session hijacking, unauthorized actions within the interface, or further internal pivoting. Exploitation requires only high-privilege GUI access, and the complexity of the attack is low.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.003 (18.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

  • Ipfire — versions 2.29
  • N/a — versions n/a

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2025-50975?
CVE-2025-50975 is a medium-severity vulnerability in Ipfire, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-08-26.
How severe is CVE-2025-50975?
Medium severity. CVSS v3 base score is 5.4 out of 10.
Is CVE-2025-50975 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.