CVE-2025-34309

CVE-2025-34309 is a stored cross-site scripting (XSS) vulnerability affecting IPFire versions prior to 2.29 (Core Update 198). An authenticated attacker can inject malicious JavaScript into the SERVICE, LOGIN, or PASSWORD parameters when managing Dynamic DNS hosts. These unsanitized inputs are later rendered in the web interface, allowing script execution in the context of other users viewing or editing these entries. The vulnerability has a CVSS score of 5.4 (Medium), indicating it can be exploited remotely with low attack complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. While it requires authentication, the stored nature of the XSS means a single successful injection can affect multiple users. Currently, there is no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE. Its EPSS score is very low, suggesting a minimal probability of exploitation in the wild.