7.2
HighCVSS 3.1 · from VulnCheck
CVE-2026-119409
OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
core · OS command injection · CWE-78Affectedcore
FixUpdate to 26.7.8 or newer
PublishedOct 30, 11:30 · VulnCheck
ScoredOct 30 · 7.2 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incorebefore 26.7.826.7.8coreNot affected26.7.8
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known