CVE-2026-119409 in OPNsense
Summary
by MITRE • 10/30/2026
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in OPNsense versions prior to 26.7.8 represents a critical command injection flaw within the firmware management subsystem. This specific weakness arises from improper neutralization of special elements used in operating system commands, specifically during the processing of user-supplied input for firmware mirror configuration. The root cause lies in how the opnsense-update utility handles data received via POST requests to the /api/core/firmware/set endpoint. Instead of strictly validating or sanitizing the URL provided by the authenticated administrator, the system passes this value directly into an eval function. This architectural decision allows shell metacharacters embedded within the input string to be interpreted and executed as part of the operating system command line rather than being treated as literal data for a mirror address.
From a privilege perspective, this vulnerability is particularly severe because it requires authentication with the System: Firmware role. While this restricts access to users who already possess elevated privileges, the ability to escalate these rights to root execution via simple input manipulation significantly lowers the barrier for exploitation within an administrative context. An attacker or malicious insider can exploit this by submitting a crafted URL containing shell metacharacters such as semicolons, pipes, or backticks through the API endpoint. When the system processes this request, it invokes eval on the unsanitized string, effectively allowing arbitrary command execution with root-level permissions. This bypasses standard security controls that would otherwise restrict administrative actions to their intended scope.
Beyond direct code execution, the vulnerability also facilitates a secondary attack vector involving package signature verification. By leveraging sed injection techniques within the same input stream, an attacker can modify configuration files or scripts responsible for validating software packages. Specifically, this allows the disabling of cryptographic checks on installed extensions and system components. This undermines the integrity assurance mechanisms that protect OPNsense from installing compromised or tampered firmware updates. The combination of arbitrary code execution and the ability to disable signature verification creates a comprehensive compromise scenario where an attacker can not only take control of the firewall but also ensure persistent access by bypassing future security checks on package installations.
The operational impact of this vulnerability is profound, as it compromises the confidentiality, integrity, and availability of the network perimeter device. Root-level command execution enables attackers to exfiltrate sensitive configuration data, including VPN credentials, SSL certificates, and internal network topology details. Furthermore, by disabling signature verification, an attacker can install malicious packages that provide persistent backdoors or facilitate lateral movement into the protected internal network. This transforms a single administrative account compromise into a full system takeover with long-term persistence capabilities. The vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is associated with ATT&CK techniques related to command and script interpretation as well as defense evasion through modification of security software configurations.
Mitigation strategies must prioritize immediate patching to version 26.7.8 or later, where the input validation logic has been corrected to prevent shell metacharacter injection during firmware mirror updates. In environments where patching is not immediately feasible, administrators should restrict access to the System: Firmware privilege group strictly to trusted personnel and monitor API logs for anomalous POST requests containing special characters in URL fields. Additionally, implementing strict network segmentation limits the blast radius if an administrative account is compromised. Regular audits of package signature verification settings can help detect any unauthorized modifications resulting from exploitation attempts. Ultimately, adhering to least-privilege principles and ensuring timely updates are essential defenses against this class of input validation failures.