CVE-2025-50989 Command injection in OPNsense
An authenticated administrator can inject shell commands via the Bridge Interface Edit endpoint, leading to remote code execution with root privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-50989?
CVE-2025-50989 is a critical command injection vulnerability in OPNsense, published on 27 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lateral movement. This vulnerability arises from inadequate input validation and improper handling of user-supplied data in backend command invocations.
Which versions are affected by CVE-2025-50989?
It affects 1 product.
Products include Opnsense Opnsense.
How do I fix CVE-2025-50989?
No fix has been published for CVE-2025-50989 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-50989 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-50989 exists.
Other vulnerabilities in OPNsense
Sources
Also known as GHSA-qf7f-cgq3-xfvh.