OPNsense vulnerabilities

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.8, unsanitized user input was passed to the DHCP configuration, allowing remote code execution as root on the underlying operating system.

OPNsense is a FreeBSD based firewall and routing platform. In versions prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input, leading to Remote Code Execution.

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.

OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the certificate description field. An authenticated attacker can inject arbitrary HTML or JavaScript via the trust certificate API, and the unsanitized description is rendered in the Dashboard Certificates widget, causing script execution in the browser of any authenticated user.

OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the firewall rule description field. An authenticated attacker with firewall rule management privileges can inject arbitrary HTML or JavaScript via the filter API endpoint, and the unsanitized description is rendered through the default cell formatter in opnsense_bootgrid.js, causing script execution in the browser of any authenticated user.

OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 were found to have insecure permissions on the /tmp directory. This vulnerability could allow a local attacker to access sensitive data or escalate privileges.