External risk intelligence

OPNsense Configuration Directory Insecure Permissions Allow Sensitive Information Access and Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-39004

OPNsense is a firewall and routing platform typically deployed at the network edge as a gateway. While the vulnerability involves local file permissions, the product itself is designed as an internet-facing appliance, making the management interface and system configuration surfaces commonly exposed or adjacent to the network perimeter in real-world deployments.

Privilege Escalation

Opnsense

before 23.7

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw exists in the configuration directory of OPNsense firewall software, potentially exposing sensitive system information like hashed passwords. This could allow unauthorized access and elevation of privileges within the network.

Configuration files expose sensitive data.
Protects network access and critical system data.
Verify relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target the configuration directory of OPNsense, which is often exposed externally as it's a firewall and routing platform. By exploiting insecure permissions in this directory, an attacker could potentially gain access to sensitive information, such as hashed root passwords, which could then be used to escalate their privileges on the system.

Unauthenticated network access required.
Insecure permissions in configuration directory.
Sensitive information disclosure leading to privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to read sensitive configuration files, including hashed root passwords, from the OPNsense system. If successful, an attacker could potentially escalate their privileges on the system.

Sensitive configuration files.
Unauthenticated network access.
Potential privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The affected technology is OPNsense, a firewall and routing platform commonly deployed at the network edge. Responsibility for addressing this vulnerability likely falls to the infrastructure or platform team managing the OPNsense deployment, in coordination with the network and security teams responsible for perimeter security. The first practical step is to identify all OPNsense instances, confirm their exposure and criticality, and then initiate a risk-based remediation plan, which may involve vendor coordination and maintenance window planning.

Infrastructure and platform teams own remediation.
Verify external reachability and critical systems.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OPNsense and why is it used?

OPNsense is an open-source firewall and routing platform designed to secure network perimeters. It provides essential security functions, such as traffic filtering, VPN management, and network monitoring. It is typically deployed as a gateway or edge device, serving as a protective barrier between internal private networks and the broader internet to control traffic flow and prevent unauthorized access.

How does CVE-2023-39004 relate to insecure permissions?

This vulnerability falls under CWE-732, which refers to incorrect permission assignments for critical resources. In OPNsense, specific system configuration files within the '/conf/' directory were accessible with improper permissions. This weakness allows unauthorized users to read sensitive data stored in those files, such as hashed root passwords, which provides the necessary building blocks for an attacker to escalate their privileges and compromise the entire system.

What triggers this vulnerability in OPNsense?

The flaw is triggered when an attacker successfully accesses the affected configuration directory. Because the directory lacks strict access controls, the system essentially makes sensitive information available to unauthorized parties over the network. It is important to note that this is not caused by user misconfiguration after installation; rather, it is a flaw inherent to the software's default file permission settings in the identified versions.

Do I need to worry about this CVE if my OPNsense instance is internal?

Halo Surface Signal notes that OPNsense is commonly deployed as an internet-facing gateway, which significantly increases the risk profile for this vulnerability. While internal-only instances face a smaller attack surface, the sensitivity of the exposed files makes this a high-priority concern for any environment. You should assess where your OPNsense appliances are positioned relative to the network perimeter to determine the immediate risk to your configuration data.

How should I respond to this OPNsense vulnerability?

Begin by creating an inventory of all OPNsense instances in your environment to identify which systems are running affected versions. Once identified, prioritize these systems based on their role and network exposure. Consult the vendor's official security guidance to apply the necessary updates or patches that correct the directory permissions. Coordinate these changes with your team to perform the update during a scheduled maintenance window.

References

logicaltrust.net/blog/2023/08/opnsense.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.