External risk intelligence

OPSI Client Information Disclosure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-22956

OPSI is a client management and software deployment system. While it typically operates within internal corporate networks to manage endpoints, its server-side components may be network-reachable in some distributed organizational deployments or multi-site environments. However, it is not inherently designed as a public-facing internet edge service.

Information Disclosure

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in OPSI, a system used for client management and software deployment. This issue could potentially allow unauthorized access to sensitive information, such as credentials, if certain configurations are present. The main concern is confirming whether this system is deployed in a way that makes it relevant to our environment.

Unauthorized access to sensitive information is possible.
High impact if sensitive data is exposed.
Confirm relevance and exposure within our systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the OPSI system without needing any credentials. Once inside, they can view sensitive information, such as passwords for domain join accounts, that are meant for specific clients only. This exposure of private data can allow the attacker to elevate their privileges within the system.

No authentication required for access.
Any client can retrieve any state.
Risk of unauthorized data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow any client to access sensitive information stored by other clients, such as credentials for joining a domain, when the system is configured in a specific way. This exposure could potentially lead to unauthorized access or control over other systems.

System credentials for domain joining.
Any client may retrieve secret data.
Privilege escalation and unauthorized access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This vulnerability in OPSI affects client management and software deployment, suggesting that platform or infrastructure teams responsible for managing endpoints and the OPSI server are likely accountable. The immediate first step is to identify all OPSI instances, confirm their network reachability and criticality, and locate the owner responsible for the specific OPSI deployment to prioritize remediation efforts.

Platform/Infrastructure teams own resolution.
Verify OPSI server network exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OPSI?

OPSI is a software management system used by administrators to automate operating system installations, distribute software packages, and manage configurations across large fleets of client machines within an organization.

What does CVE-2025-22956 mean by information disclosure?

This vulnerability, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), allows a client to read data belonging to other clients. It essentially breaks the intended access restrictions, enabling a user to potentially see secrets, such as domain credentials, that they should not be able to view.

How does an attacker trigger this vulnerability?

The issue does not require the attacker to have pre-existing authentication or special privileges. If a client can communicate with the OPSI server, it can request and receive the configuration states of other machines. Simply querying the server for another client's ProductPropertyState is enough to retrieve the sensitive data; it does not require complex exploitation techniques.

Is my OPSI instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a potential risk because while OPSI is typically an internal tool, some organizations distribute it across multiple sites or networks. If your OPSI server is reachable over a broader network—or accidentally exposed—the risk increases. It is generally not intended to be a public-facing internet service.

Do I need to take action if I use OPSI?

Yes. Start by identifying all OPSI server instances within your environment and verifying their network reachability. Coordinate with your platform or infrastructure teams to review the deployment, ensure proper network segmentation is in place, and track upcoming software updates for OPSI version 4.3 or later to address the root cause.

References

opsi.org/en/product/releases/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.