CVE-2023-39001
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
A command injection vulnerability in the diag_backup.php component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.
Risk Assessment
This vulnerability may lead to unauthorized access to the system and execution of malicious code, posing a serious threat to the organization's security.
Recommendation
It is recommended to update OPNsense to the latest version to mitigate this vulnerability and to review and validate backup configuration files.
Original NVD description (English source)
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.