Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

OPNsense 19.1 Allows Malicious Script Injection via VPN Settings

CVE-2019-25374 · published 8 months ago
Summary

OPNsense 19.1 has a security weakness that lets hackers inject malicious scripts into users' web browsers. This can happen when an attacker sends a specific type of request to the OPNsense web interface. To stay safe, update to a fixed version of OPNsense or apply the available patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
opnsense opnsense 19.1
cpe:2.3:a:opnsense:opnsense:19.1:*:*:*:*:*:*:*
Original advisory text
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. A...
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. Attackers can craft POST requests with JavaScript payloads in the passthrough_networks parameter to execute arbitrary code in users' browsers.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2019-25374 · NVD
CVE-2019-25374 · OSV
Track software like this
Free during beta