CVE-2025-50989

OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lateral movement. This vulnerability arises from inadequate input validation and improper handling of user-supplied data in backend command invocations.

• CWE-78
• CWE-77

• https://github.com/4rdr/proofs/blob/main/info/OPNsense-25.1-Command-Injection-via-span-parameter.mdExploit, Third Party Advisory
• https://github.com/opnsense/changelog/blob/640e96ed6a783254283aead0d0b744fc9143ce6d/community/25.1/25.1.8#L34Product

Published

Aug 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-50979NodeBB v4.3.0 is vulnerable to SQL injection in its search-c…8.6
• CVE-2025-5098PrinterShare Android application allows the capture of Gmail…9.1
• CVE-2025-50983SQL Injection vulnerability exists in the sortKey parameter …8.3
• CVE-2025-50984diskover-web v2.3.0 Community Edition is vulnerable to multi…5.3
• CVE-2025-50985diskover-web v2.3.0 Community Edition is vulnerable to multi…5.6
• CVE-2025-50986diskover-web v2.3.0 Community Edition suffers from multiple …5.6
• CVE-2025-5099An Out of Bounds Write occurs when the native library attemp…9.8
• CVE-2025-5100A double-free condition occurs during the cleanup of tempora…8
• CVE-2025-51005A heap-buffer-overflow vulnerability exists in the tcplivepl…7.5
• CVE-2025-51006Within tcpreplay's tcprewrite, a double free vulnerability h…7.8
• CVE-2025-5101An issue has been discovered in GitLab CE/EE affecting all v…5
• CVE-2025-5102Rejected reason: This CVE ID has been rejected or withdrawn …