OPNsense CVE-2026-58390

Exploitation requires a specific, non-default identity configuration: an OpenVPN server set to username-as-common-name with RADIUS or LDAP authentication, where the attacker can provision or self-register a valid backend username containing a double-quote character. A separate trust boundary must exist - the advisory explicitly states deployments where one administrator controls both the identity backend and the firewall do not cross a trust boundary, and the local user database is not exploitable because its username validator rejects quotes. Execution further depends on a firewall administrator opening the OpenVPN dashboard widget or connection-status page AND triggering the injected event handler (the demonstrated payload required pointer movement over the client row, not unconditional page-load execution). These factors - external RADIUS/LDAP backend, quote-permitting username provisioning, and active admin interaction - substantially limit realistic exploitation despite the network attack vector.

This is a high-severity stored XSS (CWE-79, CVSS 8.0) in the OPNsense OpenVPN connection-status dashboard widget that chains to full administrative/root compromise of the firewall. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) is internally consistent with the description: network-reachable but gated by high attack complexity, low-privilege authentication, required administrator interaction, and a scope change from the victim admin's browser to root on the firewall. Real-world risk is tempered by several converging limiters rather than inflated: AC:H reflects the narrow preconditions (username-as-common-name mode plus RADIUS/LDAP backend plus a separate trust boundary plus an attacker-controllable username containing a double quote), and UI:R reflects that the demonstrated payload fired on pointer movement over the client row, not on page load. No EPSS score was provided, no CISA KEV listing is indicated, and no public exploit flag was supplied - so there is no signal of active exploitation or mass scanning; the only exploitation evidence is the vendor's own advisory demonstration. Because the preconditions require a federated/outsourced identity backend distinct from firewall administration (the advisory explicitly notes same-admin deployments do not cross a trust boundary), this is a genuine but targeted/conditional priority rather than a broadly wormable internet threat. Net: treat as a high-priority patch for organizations running OpenVPN with external RADIUS/LDAP and username-as-common-name, lower urgency for single-administrator or local-DB deployments.

In an environment where OPNsense authenticates OpenVPN users against RADIUS/LDAP in username-as-common-name mode, an attacker who can self-register or provision a backend username containing a double quote injects a broken-out data-common-name attribute carrying an event handler. When a firewall administrator later opens the OpenVPN dashboard widget or connection-status page and moves the pointer over the malicious client's row, the script runs in the admin's authenticated session, reading config.xml and invoking privileged APIs to reset the root password and achieve root command execution. No standalone public exploit is indicated beyond the vendor advisory, which demonstrates the full chain.