CVE-2019-25374: OPNsense 19.1 Reflected XSS via vpn_ipsec_settings.php

Published Feb 15, 2026

Updated

OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthroughnetworks parameter in vpnipsecsettings.php. Attackers can craft POST requests with JavaScript payloads in the passthroughnetworks parameter to execute arbitrary code in users' browsers.

Affected Software

2 affected components

OPNsense OPNsense

OPNsense OPNsense=19.1

Remediation

Information

OPNsense 19.1.1 released

Event History

Feb 15, 2026

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Dec 7, 58362

Event

via NVD·12:21 AM

Frequently Asked Questions

What is the severity of CVE-2019-25374?

CVE-2019-25374 is classified as a medium severity vulnerability due to its ability to exploit reflected cross-site scripting.

How do I fix CVE-2019-25374?

To remediate CVE-2019-25374, update OPNsense to the latest version that addresses this reflected XSS vulnerability.

What type of attack does CVE-2019-25374 enable?

CVE-2019-25374 enables attackers to execute arbitrary JavaScript in the context of the user's session.

Which parameter is vulnerable in CVE-2019-25374?

The passthrough_networks parameter in vpn_ipsec_settings.php is vulnerable in CVE-2019-25374.

Are all versions of OPNsense affected by CVE-2019-25374?

CVE-2019-25374 specifically affects OPNsense version 19.1.