CVE-2025-50989

OPNsense is the software that runs your business firewall, controlling what traffic can enter and leave your network. This flaw is like a hidden trapdoor in one of its admin settings screens: someone who already has an administrator login can type a hidden command into a form field and have the firewall's underlying computer execute it with full control. The real-world risk is that a malicious or compromised admin account could hijack your entire firewall device, not just change settings.

This matters to you if you run OPNsense as your firewall or router, on versions before 25.1.8. Exploitation requires the attacker to already have an administrator-level login on the OPNsense web interface, so it is most relevant if you have multiple admin accounts, shared/weak admin credentials, or an admin panel exposed to untrusted networks.

This is a serious, credible risk — a working exploit is publicly available online — but there is no evidence yet of attackers actively using it against real businesses, and it does require an admin-level login first. Treat this as a priority to patch soon, not an emergency to drop everything for tonight; rising press attention also means more people are now aware of it, which increases the chance of future attacks.

1. Inventory all OPNsense deployments and confirm version via System > Firmware > Status. 2. Any instance below 25.1.8 is vulnerable; the fix is to upgrade to 25.1.8 or later — no breaking-change notes have been reported for this specific fix. 3. As exploitation requires an authenticated admin session, as an interim mitigation reduce the number of admin accounts, enforce strong unique credentials and MFA where supported, and ensure the web GUI is not exposed to the internet or untrusted networks. 4. A public PoC targeting interfaces_bridge_edit.php's 'span' POST parameter exists on GitHub, so treat this as weaponizable; prioritize patching ahead of routine cycles. 5. Not currently in CISA KEV, so no federal remediation deadline applies, but EPSS is rising (10.1%, 96th percentile) indicating increasing attacker interest. 6. Monitor firewall logs for unexpected admin-panel command execution or configuration changes you didn't make, and monitor vendor advisories for any update to exploitation status.

CVSS 9.1 (Critical), AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H — network-exploitable with low complexity but requiring high privileges (authenticated admin). Weakness: CWE-78/CWE-77 (OS command injection via improper neutralization of special elements). The 'span' POST parameter in interfaces_bridge_edit.php is concatenated unsanitized into a system-level call, enabling shell metacharacter injection and RCE as the web service user (typically root). Exploit maturity: one public PoC on GitHub, no confirmed in-the-wild exploitation, not listed in CISA KEV. EPSS 10.1% (96th percentile) with a rising trend, reflecting elevated predicted likelihood but not confirmed exploitation.