CVE-2025-50989: OS Command Injection
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfacesbridgeedit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lateral movement. This vulnerability arises from inadequate input validation and improper handling of user-supplied data in backend command invocations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50989?
CVE-2025-50989 has been rated as a critical vulnerability due to its potential for authenticated command injection.
How do I fix CVE-2025-50989?
To fix CVE-2025-50989, upgrade to the latest version of OPNsense where the vulnerability has been patched.
What systems are affected by CVE-2025-50989?
CVE-2025-50989 affects OPNsense version 25.1 and potentially prior versions.
What exploitation methods are possible with CVE-2025-50989?
An attacker could exploit CVE-2025-50989 by injecting arbitrary shell commands through the span POST parameter in the Bridge Interface Edit endpoint.
Who is responsible for resolving CVE-2025-50989?
Resolution of CVE-2025-50989 falls on users of OPNsense to ensure they update their systems promptly.