CVE-2023-39001

Deeper analysis

A command injection vulnerability exists in the diag_backup.php component of OPNsense Community Edition before version 23.7 and Business Edition before 23.4.2. The flaw, tracked as CVE-2023-39001 and assigned CWE-77, permits unauthenticated attackers to supply a crafted backup configuration file that results in arbitrary command execution on the affected system. It carries a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker can exploit the issue remotely by uploading a maliciously formatted backup file to the diag_backup.php endpoint. Successful exploitation grants full control over the target appliance, including the ability to read, modify, or delete data and execute system-level commands with the privileges of the OPNsense process.

Public references point to a fix committed in the OPNsense core repository that addresses the injection path in diag_backup.php. Administrators are advised to upgrade to Community Edition 23.7 or Business Edition 23.4.2 or later to obtain the patched code.

The associated EPSS score has remained flat at 0.0550 with no material increase since disclosure.