{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopnsenseos_acme_client/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:opnsense:os_acme_client:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-123025"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["os-acme-client (\u003c= 4.17)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-123025","vulnerability","command-injection","opnsense"],"_cs_type":"advisory","_cs_vendors":["OPNsense"],"content_html":"\u003cp\u003eCVE-2026-123025 is an OS command injection vulnerability within the Google Cloud DNS validation module of the OPNsense os-acme-client plugin, affecting versions 4.17 and earlier. The vulnerability exists in the DnsGcloud::prepare() method, where the gcloud_account and gcloud_project fields are interpolated into shell commands passed to proc_open() via LeUtils::run_shell_command() without sufficient sanitization. A remote authenticated user with access to the WebGUI or API for certificate management can inject arbitrary shell commands, resulting in code execution with root privileges.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote authenticated attacker to execute arbitrary commands on the affected OPNsense device with root-level permissions.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all OPNsense instances running the os-acme-client plugin to identify vulnerable versions (4.17 or earlier).\u003c/li\u003e\n\u003cli\u003eMonitor WebGUI and API access logs for unusual activity involving certificate management endpoints, particularly those interacting with the Google Cloud DNS validation configuration.\u003c/li\u003e\n\u003cli\u003eApply the security update provided by the vendor via the official OPNsense repository immediately upon availability.\u003c/li\u003e\n\u003cli\u003eRestrict access to the OPNsense WebGUI and API to trusted administrative sources to mitigate the risk of unauthorized exploitation.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-05T09:06:00Z","date_published":"2026-11-05T09:06:00Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123025/","summary":"An OS command injection vulnerability in the OPNsense os-acme-client plugin allows remote authenticated users to achieve root code execution by manipulating DNS validation parameters.","title":"OPNsense os-acme-client: OS command injection via DNS validation (CVE-2026-123025)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123025/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:opnsense:os_acme_client:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}