OPNsense CVE-2025-13698

Requires an authenticated, high-privilege (administrator-level) session on the OPNsense web GUI AND network-adjacent access to the management interface (AV:A), per the CVSS vector and description stating 'Authentication is required.' The specific trigger is the configuration backup/restore handler in diag_backup.php, where the user-supplied backup filename is not validated for path-traversal sequences before being used in file operations, allowing files to be created as root outside the intended /conf/backup (and RRD /var/db/rrd) directories. Limiting factors that reduce real-world risk: the attacker must already hold valid admin credentials or a hijacked admin session, must be on an adjacent network segment rather than the open internet, and no user interaction by a victim is needed (UI:N) but privileged access is the gating barrier.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 3.0 base score is 4.5 (Medium) with vector AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N: exploitation is constrained to a network-adjacent position and - critically - requires PR:H, meaning an already-authenticated high-privilege (administrative) user. EPSS is low at 0.61% (48th percentile), the CVE is NOT in CISA KEV, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' Mapped to an SSVC-style view: exploitation = none observed, automatable = no (requires valid admin authentication and adjacency), technical impact = total (files are created in the context of root, which can escalate to full compromise despite the base score only crediting I:H). The key tension is that the technical impact (arbitrary root-owned file creation, a realistic stepping stone to RCE/persistence) is far more severe than the 4.5 score suggests, but the preconditions (adjacent + admin auth) heavily gate real-world risk. This is a legitimate patch-and-move-on item for defense-in-depth against a rogue or compromised admin, not a drop-everything emergency.

An authenticated administrator (or an attacker who has hijacked/obtained an admin session on the same management network segment) submits a crafted configuration backup restore via diag_backup.php where the filename contains directory-traversal sequences. Because the user-supplied path is not validated before the file operation, a file is written outside the intended backup directory in the root context, which can be used to drop or overwrite system files and pivot toward code execution. No public exploit code is identified at time of analysis, though the vendor fix commit is public and could aid reverse-engineering.