Insecure Permissions in OPNsense Community and Business Editions
CVE-2023-39004

9.8CRITICAL

Key Information:

Vendor

Opnsense

Status
Opnsense
Vendor
CVE Published:
9 August 2023

What is CVE-2023-39004?

The OPNsense Community and Business Editions exhibit insecure permissions in their configuration directory (/conf/), potentially allowing attackers to access sensitive data such as hashed root passwords. This vulnerability can facilitate unauthorized privilege escalation. It is crucial for users running versions prior to 23.7 and 23.4.2, respectively, to take immediate action to secure their installations and safeguard sensitive information. For further details, please refer to the official documentation.

References

http://opnsense.com
https://logicaltrust.net/blog/2023/08/opnsense.html

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.