OPNsense: Remote authenticated arbitrary code execution
OPNsense contains a vulnerability that allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.
Triage facts
Revision 1- Applicability
- OPNsense
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 12:14 UTC
- Source quality
- A3Likely
A vulnerability in OPNsense allows a remote, authenticated attacker to achieve arbitrary code execution with administrator privileges. No CVE identifier is provided in the current BSI advisory. Users are advised to monitor the official OPNsense security announcements for patch availability and further technical details.
Impact
Successful exploitation allows an authenticated attacker to execute arbitrary code with administrative rights, potentially leading to full system compromise of the firewall appliance.
Recommendation
Inventory all OPNsense instances within the environment. Monitor official OPNsense release channels for patches addressing this vulnerability and apply them immediately upon release. Audit administrative session logs for unauthorized access or suspicious command execution.
Immediate actions
Inventory all OPNsense deployments and prepare for emergency patching
Threat Hunt
Search administrative session logs for anomalous system commands or modifications to firewall rules and services
Data: OPNsense system audit logs, web interface access logs
Mitigations
Monitor OPNsense official release notes and apply latest security updates
Arbitrary code execution vulnerability