CVE-2019-25370: OPNsense 19.1 Reflected XSS via interfaces_vlan_edit.php

Published Feb 15, 2026

Updated

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. Attackers can send POST requests to interfacesvlanedit.php with script payloads in the tag, descr, or vlanif parameters to execute arbitrary JavaScript in users' browsers.

Affected Software

2 affected components

Deciso OPNsense

OPNsense OPNsense=19.1

Remediation

Information

OPNsense 19.1.1 released

Event History

Feb 15, 2026

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Dec 7, 58362

Event

via NVD·12:28 AM

Frequently Asked Questions

What is the severity of CVE-2019-25370?

CVE-2019-25370 is classified as a medium severity vulnerability due to its potential to exploit reflected cross-site scripting.

How do I fix CVE-2019-25370?

To fix CVE-2019-25370, update OPNsense to a patched version that addresses this reflected XSS vulnerability.

What type of vulnerability is CVE-2019-25370?

CVE-2019-25370 is a reflected cross-site scripting (XSS) vulnerability affecting OPNsense.

What are the potential impacts of CVE-2019-25370?

The potential impacts of CVE-2019-25370 include unauthorized script execution in users' browsers, leading to data theft or session hijacking.

Which versions of OPNsense are affected by CVE-2019-25370?

OPNsense version 19.1 is affected by CVE-2019-25370, and users should upgrade to a later version to mitigate the risk.