OPNsense EUVD-2026-113793

Exploitation requires an authenticated OPNsense account or API key that holds the 'System: Firmware' privilege (PR:H) - no root password, SSH access, or unrestricted administrator account is needed. The concrete trigger is storing a mirror URL containing shell command-substitution metacharacters through POST /api/core/firmware/set, which survives input validation on unpatched versions; the injected command runs the next time firmware information is requested (POST→GET /api/core/firmware/info) or whenever the firmware WebUI page loads, because opnsense-update -M's mirror_abi() evaluates the stored value with eval. The related sed-injection path can additionally disable package signature verification. Limiting factors: a valid credential with the specific firmware privilege is mandatory (this is not remote-unauthenticated), and the flaw is fixed in 26.7.8 and 26.10 - the vendor patch (input masking plus removing the eval) is the complete remediation.

This is a genuine high-priority issue rather than CVSS-score inflation. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H, 8.6) describes a network-reachable, low-complexity flaw whose only real gate is authentication: PR:H confirms the attacker must be authenticated, specifically holding the 'System: Firmware' privilege. The signals are internally consistent - high confidentiality/integrity/availability impact (full root command execution on a firewall appliance) with no user interaction, offset by the credential requirement. A publicly documented, reporter-verified proof of concept exists in the vendor GHSA advisory (GHSA-p683-f7x2-pm4p) and is referenced by VulnCheck and abraxaslabs, so exploitability is not theoretical. However, there is no EPSS score in the supplied data and no CISA KEV listing, so there is no evidence of active or widespread exploitation at time of analysis - the vuln.today 'this_week' decision label reflects a serious-but-not-emergency priority. The practical risk is highest for OPNsense deployments that delegate the firmware privilege or issue scoped API keys, because this flaw lets such a limited account escalate to root and persist (the payload re-executes whenever firmware info is fetched or the firmware WebUI page loads).

An authenticated user or API key holding only the restricted 'System: Firmware' privilege submits a firmware mirror URL containing shell command-substitution syntax via POST /api/core/firmware/set. When firmware information is next retrieved (via /api/core/firmware/info or by loading the firmware WebUI page), opnsense-update's mirror_abi() passes the stored value through eval MIRROR="${MIRROR}", executing the injected command as root. A reporter-verified PoC in the vendor advisory demonstrates creation of a root:wheel-owned marker file using exactly this chain.