CVE-2023-39004
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
Risk Assessment
The risk is that an unauthorized user could gain access to the root password hash, potentially leading to full system compromise and network security breach.
Recommendation
Immediately upgrade OPNsense to version 23.7 (Community Edition) or 23.4.2 (Business Edition) and verify/restrict permissions on the /conf/ directory to prevent unauthorized access.
Original NVD description (English source)
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.