CVE-2023-39004: Critical severity OPNsense OPNsense vulnerability
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OPNsense Community Editionto a version that resolves this vulnerability.Fixed in 23.7 - Upgrade
Upgrade
OPNsense Business Editionto a version that resolves this vulnerability.Fixed in 23.4.2
Event History
Frequently Asked Questions
What is CVE-2023-39004?
CVE-2023-39004 is a vulnerability in OPNsense Community Edition and Business Edition that allows attackers to access sensitive information and potentially escalate privileges.
How severe is CVE-2023-39004?
CVE-2023-39004 has a severity rating of 9.8, which is considered critical.
How does CVE-2023-39004 occur?
CVE-2023-39004 occurs due to insecure permissions in the configuration directory (/conf/) of OPNsense.
What is the affected software version for CVE-2023-39004?
The affected software versions for CVE-2023-39004 are OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.
How can CVE-2023-39004 be exploited?
CVE-2023-39004 can be exploited by attackers to access sensitive information, such as hashed root passwords, leading to potential privilege escalation.