PT-2025-34873 · Deciso · Opnsense

4Rdr · Published 2025-08-27 · Updated 2025-09-26 · CVE-2025-50989

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OPNsense version 25.1

Description: OPNsense version 25.1 contains an authenticated command injection issue in the Bridge Interface Edit endpoint (interfaces bridge edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation could lead to remote code execution with the privileges of the web service, potentially resulting in full system compromise or lateral movement. This is due to inadequate input validation and improper handling of user-supplied data in backend command invocations.

Recommendations: Update to a newer version that contains a fix for this issue. As a temporary workaround, restrict access to the interfaces bridge edit.php endpoint. Sanitize or escape the span POST parameter before using it in system-level commands.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2025-50989

Affected Products

Opnsense

References · 9

• 🔥 https://github.com/4rdr/proofs/blob/main/info/OPNsense-25.1-Command-Injection-via-span-parameter.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-50989 · Security Note
• https://osv.dev/vulnerability/CVE-2025-50989 · Vendor Advisory
• https://github.com/opnsense/changelog/blob/640e96ed6a783254283aead0d0b744fc9143ce6d/community/25.1/25.1.8#L34 · Note
• https://t.me/cveNotify/135242 · Telegram Post
• https://t.me/cveNotify/136578 · Telegram Post
• https://reddit.com/r/opnsense/comments/1nd7rt0/cve202550989 · Reddit Post
• https://twitter.com/CVEnew/status/1960717224672731394 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1960762895421018112 · Twitter Post