OPNsense Firewall EUVD-2026-109656

Exploitation requires an authenticated low-privileged account on the OPNsense web GUI (PR:L) - it is NOT remote-unauthenticated. For the stored variant, the attacker must have write access to the Interfaces → Assignments Description field, and a second victim user must subsequently view a page that renders that interface configuration (Dashboard or Interfaces → Overview) for the payload to execute (UI:P). For the reflected variant, a victim must click/submit a crafted Firewall → Log Files → Live View search request. Limiting factors: the attacker needs valid credentials with at least interface-edit rights, victim interaction is mandatory, and all affected versions are OPNsense 26.7.1_1 and earlier. There is currently no patched version, so the only limiting control is restricting who holds low-privileged GUI accounts; the advisory states no fix is yet available.

This is a moderate-severity, authenticated client-side vulnerability rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:P) shows network reach and low attack complexity, but two signals cap real-world urgency: PR:L means the attacker must already hold a low-privileged authenticated account on the OPNsense web GUI, and UI:P means a victim must passively visit a page or click a crafted link for the payload to fire. The vector reports no impact on the vulnerable system itself (VC:N/VI:N/VA:N) but high subsequent-system impact (SC:H/SI:H/SA:H), which reflects the hijacking of the victim's authenticated session/browser context - consistent with XSS. Exploit maturity is E:P (proof-of-concept), and the GHSA advisory supplies a concrete payload and reproduction steps, so a public PoC reference exists; it is not verified as working weaponized exploit code. The CVE is NOT in CISA KEV, and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the input Decision label is 'this_month', not act_now/emergency. The main risk amplifier is that the stored variant renders across Dashboard and Interfaces → Overview and can execute in the context of any logged-in user including root, effectively enabling privilege escalation from a low-privileged operator to full firewall administrator via session/credential theft or GUI actions. No fixed version is available yet, which raises the practical priority above what the 5.6 base score alone suggests for environments where untrusted low-privileged GUI accounts exist.

A low-privileged OPNsense operator stores the payload '><script>alert('xss')</script> in the Description field under Interfaces → Assignments; when an administrator (including root) later views the Dashboard or Interfaces → Overview, the JavaScript executes in their authenticated session. Alternatively, an attacker crafts a link to Firewall → Log Files → Live View with a malicious search parameter and lures an authenticated user into clicking it, triggering reflected JavaScript immediately. A public PoC reference with the exact payload and steps is published in the GHSA advisory, though it is not verified as working weaponized exploit code.