CVE-2023-39003
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 were found to have insecure permissions on the /tmp directory. This vulnerability could allow a local attacker to access sensitive data or escalate privileges.
Risk Assessment
Insecure permissions on the /tmp directory could allow unauthorized users to read, modify, or delete temporary files, potentially leading to data leakage or system compromise.
Recommendation
Immediately update OPNsense Community Edition to version 23.7 or later, and Business Edition to version 23.4.2 or later. After updating, verify and correct permissions on the /tmp directory.
Other vulnerabilities in OPNsense
See all- CVE-2026-45158Critical
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.8, unsanitized user input was passed to the DHCP configuration, allowing remote code execution as root on the underlying operating system.
- CVE-2026-44193Critical
OPNsense is a FreeBSD based firewall and routing platform. In versions prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input, leading to Remote Code Execution.
- CVE-2023-39004Critical
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
- CVE-2026-49132Medium
OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the certificate description field. An authenticated attacker can inject arbitrary HTML or JavaScript via the trust certificate API, and the unsanitized description is rendered in the Dashboard Certificates widget, causing script execution in the browser of any authenticated user.
- CVE-2026-49131Medium
OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the firewall rule description field. An authenticated attacker with firewall rule management privileges can inject arbitrary HTML or JavaScript via the filter API endpoint, and the unsanitized description is rendered through the default cell formatter in opnsense_bootgrid.js, causing script execution in the browser of any authenticated user.
Original NVD description (English source)
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.