EUVD-2026-30183Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.
AnalysisAI
Remote code execution in OPNsense firewall versions prior to 26.1.7 allows authenticated high-privileged users to execute arbitrary code via the opnsense.restore_config_section XMLRPC method, which fails to sanitize user-supplied input. The flaw carries a CVSS 9.1 with scope change and total impact, and while publicly available exploit code exists per SSVC, EPSS rates real-world exploitation probability at only 0.23%, suggesting niche rather than mass-scale risk. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reach to the OPNsense XMLRPC endpoint (typically used for High Availability config synchronization or admin tooling) AND high-privilege credentials valid for that interface (CVSS PR:H) - practically, this means the system admin password or the HA sync password. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk signals are mixed and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained high-privilege credentials for the OPNsense admin or HA sync XMLRPC interface - for example via credential theft, a compromised HA peer, or a leaked sync password - sends a crafted XMLRPC call to opnsense.restore_config_section containing unsanitized payload fragments. The malformed configuration section is processed without proper neutralization and injects attacker-controlled arguments into a downstream command, yielding arbitrary OS-level code execution on the firewall (publicly available exploit code exists per SSVC poc rating). |
| Remediation | Upgrade to OPNsense 26.1.7 or later, which is the vendor-released patch fixing input sanitization in the opnsense.restore_config_section XMLRPC handler; details are in the upstream advisory at https://github.com/opnsense/core/security/advisories/GHSA-xxp9-93cr-x54p. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Identify all OPNsense deployments and document current versions; review administrator credential security and access logs for anomalies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today