CVE-2025-50989

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-50989
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-50989.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-50989
Published
2025-08-27T15:15:38.857Z
Modified
2026-04-10T05:29:19.173714Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfacesbridgeedit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lateral movement. This vulnerability arises from inadequate input validation and improper handling of user-supplied data in backend command invocations.

References

Affected packages

Git / github.com/opnsense/core

Affected ranges

Type
GIT
Repo
https://github.com/opnsense/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1e712b11a65d80a7d231bab8bc27d3852ee86cae
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "25.1.8"
        }
    ]
}

Affected versions

15.*
15.1
15.1.1
15.1.10
15.1.10.2
15.1.11
15.1.11.1
15.1.11.2
15.1.11.3
15.1.11.4
15.1.12
15.1.2
15.1.3
15.1.4
15.1.5
15.1.6
15.1.6.1
15.1.7
15.1.7.1
15.1.7.2
15.1.8
15.1.8.1
15.1.8.2
15.1.8.3
15.1.8.4
15.1.9
15.1.9.1
15.1.9.2
15.7
16.*
16.7.a
16.7.b
16.7.r
17.*
17.1.a
17.1.b
17.1.r
17.7.a
17.7.b
17.7.r
18.*
18.1.a
18.1.b
18.1.r
18.7.a
18.7.b
18.7.r
19.*
19.1.a
19.1.b
19.1.r
19.7.a
19.7.b
19.7.r
20.*
20.1.a
20.1.b
20.1.r
20.7.a
20.7.b
20.7.r
21.*
21.1.a
21.1.b
21.1.r
21.7.a
21.7.b
21.7.r
22.*
22.1.a
22.1.b
22.1.r
22.7.a
22.7.b
22.7.r
23.*
23.1.a
23.1.b
23.1.r
23.7.a
23.7.b
23.7.r
24.*
24.1.a
24.1.b
24.1.r
24.7.a
24.7.b
24.7.r
25.*
25.1
25.1.1
25.1.2
25.1.3
25.1.4
25.1.5
25.1.6
25.1.7
25.1.a
25.1.b
25.1.r
25.1.r1
25.1.r2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-50989.json"