1. Home
  2. CVE Database
  3. CVE-2023-39004
CRITICAL · 9.8

CVE-2023-39004

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed ...

Vulnerability Description

Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
OpnsenseOpnsense< 23.7

Related Weaknesses (CWE)

CWE-732

References

FAQ

What is CVE-2023-39004?

CVE-2023-39004 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed ...

How severe is CVE-2023-39004?

CVE-2023-39004 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2023-39004?

Check the references section above for vendor advisories and patch information. Affected products include: Opnsense Opnsense.