CVE-2025-34176 is a directory traversal vulnerability in pfSense CE, specifically within the /suricata/suricata_ip_reputation.php component. An authenticated attacker with "WebCfg - Services: suricata package" permissions can exploit this by manipulating the 'iplist' parameter to check for the existence of arbitrary files on the server. This allows for file enumeration, though not file content disclosure. The vulnerability has a CVSS score of 4.3 (Medium) due to its low impact (C:L) and requires authentication (PR:L). There is currently no public exploit code, active exploitation, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.8.0CPE matchmatch criteria | cpe:2.3:a:pfsense:pfsense:*:*:*:*:community:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.