OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
OPNsense core up to 26.7.7 and up to 26.4.2p5 lets a user with only the System: Firmware privilege run shell commands as root through the firmware mirror setting. Fixed in 26.7.8 and 26.10.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 26.7.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
OPNsense firewall software (versions before the 26.7.8 fix) is affected. An authenticated user with firmware privileges can exploit it to run arbitrary commands with root access on the firewall, potentially taking full control of the device and disabling package signature checks.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- opnsense core
fixed in 26.7.8
References 8
GitHub · opnsense/core
GitHub · opnsense/update
abraxaslabs.tech
Questions about CVE-2026-119409
What does this mean?
A user who holds only the System: Firmware privilege can store a malicious firmware mirror URL and run arbitrary operating-system commands with root-level privileges.Source: github.com
Am I affected, and how do I check?
Affected versions are OPNsense core up to 26.7.7 and up to 26.4.2p5. The attacker must hold an authenticated account with the System: Firmware privilege. Check the installed core version against those ranges.Source: github.com
What should I do about it?
Upgrade to OPNsense 26.7.8 or 26.10, which contain the fix.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data