CVE-2025-50976

IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Reflected-XSS-via-DNS.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ipfire:ipfire:2.29:-:*:*:*:*:*:*

History

09 Sep 2025, 18:55

Type	Values Removed	Values Added
References	~~() https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Reflected-XSS-via-DNS.md -~~	() https://github.com/4rdr/proofs/blob/main/info/IPFire-2.29-Reflected-XSS-via-DNS.md - Exploit, Third Party Advisory
First Time		Ipfire ipfire Ipfire
CPE		cpe:2.3:a:ipfire:ipfire:2.29:-::::::

27 Aug 2025, 17:15

Type	Values Removed	Values Added
Summary		(es) La interfaz de administración de DNS de IPFire 2.29 (dns.cgi) no logra depurar adecuadamente la entrada proporcionada por el usuario en los parámetros de consulta NAMESERVER, REMARK y TLS_HOSTNAME, lo que genera una vulnerabilidad de cross-site scripting (XSS) reflejado.
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.1
CWE		CWE-79

26 Aug 2025, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-26 18:15

Updated : 2025-09-09 18:55

NVD link : CVE-2025-50976

Mitre link : CVE-2025-50976

CVE.ORG link : CVE-2025-50976

JSON object : View

Products Affected

ipfire

ipfire

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

6.1 /10