Deciso OPNsense Command Injection Vulnerability in diag_backup.php Allowing Remote Code Execution

A command injection vulnerability has been identified in the Deciso OPNsense web interface, specifically in the diag_backup.php file. This vulnerability allows authenticated, network-adjacent attackers to execute arbitrary code with root privileges on the affected system. The issue arises from inadequate validation of user-supplied input, which is used to execute system commands. As a result, attackers can manipulate the input to execute malicious code on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the root user.

Remediation

Deciso has released a patch for this vulnerability. Users are advised to update to the latest version of OPNsense. Instructions for updating can be found in the OPNsense documentation.