Os-Acme-Client (<= 4.17) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/os-acme-client--4.17/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 09:06:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOPNsense os-acme-client: OS command injection via DNS validation (CVE-2026-123025)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-123025/Thu, 05 Nov 2026 09:06:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-123025/An OS command injection vulnerability in the OPNsense os-acme-client plugin allows remote authenticated users to achieve root code execution by manipulating DNS validation parameters.CVE-2026-123025 is an OS command injection vulnerability within the Google Cloud DNS validation module of the OPNsense os-acme-client plugin, affecting versions 4.17 and earlier. The vulnerability exists in the DnsGcloud::prepare() method, where the gcloud_account and gcloud_project fields are interpolated into shell commands passed to proc_open() via LeUtils::run_shell_command() without sufficient sanitization. A remote authenticated user with access to the WebGUI or API for certificate management can inject arbitrary shell commands, resulting in code execution with root privileges.

Impact

Successful exploitation allows a remote authenticated attacker to execute arbitrary commands on the affected OPNsense device with root-level permissions.

Recommendation

  1. Inventory all OPNsense instances running the os-acme-client plugin to identify vulnerable versions (4.17 or earlier).
  2. Monitor WebGUI and API access logs for unusual activity involving certificate management endpoints, particularly those interacting with the Google Cloud DNS validation configuration.
  3. Apply the security update provided by the vendor via the official OPNsense repository immediately upon availability.
  4. Restrict access to the OPNsense WebGUI and API to trusted administrative sources to mitigate the risk of unauthorized exploitation.
]]>highadvisorycve-2026-123025vulnerabilitycommand-injectionopnsense