Lucene search
HistoryAug 09, 2023 - 7:15 p.m.
CVE-2023-39001
vulnerability
opnsense
command injection
diag_backup.php
arbitrary commands
backup configuration file
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
48.6%
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file.
Affected configurations
Node
opnsenseopnsenseRange<23.7
Related
cvelist
cvelist
CVE-2023-39001
2023-08-09 00:00:00
cve
cve
CVE-2023-39001
2023-08-09 19:15:14
prion
prion
Command injection
2023-08-09 19:15:00
osv
osv
CVE-2023-39001
2023-08-09 19:15:14
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
48.6%
Related for NVD:CVE-2023-39001