CVE-2019-25371: OPNsense 19.1 Reflected XSS via diag_ping.php

Published Feb 15, 2026

Updated

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted POST requests to the diagping.php endpoint with script payloads in the host parameter to execute arbitrary JavaScript in users' browsers.

Affected Software

2 affected components

OPNsense OPNsense

OPNsense OPNsense=19.1

Remediation

Information

OPNsense 19.1.1 released

Event History

Feb 15, 2026

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-25371?

CVE-2019-25371 is classified as a reflected cross-site scripting vulnerability with a medium severity level.

How do I fix CVE-2019-25371?

To fix CVE-2019-25371, upgrade to the latest version of OPNsense that includes patches for this vulnerability.

Who is affected by CVE-2019-25371?

CVE-2019-25371 affects OPNsense version 19.1 specifically.

What type of attack can exploit CVE-2019-25371?

CVE-2019-25371 can be exploited through a reflected cross-site scripting attack via crafted POST requests.

Can unprivileged users exploit CVE-2019-25371?

Yes, CVE-2019-25371 allows unauthenticated attackers to exploit the vulnerability.