OPNsense EUVD-2026-113804

Exploitation requires (1) an authenticated account with the OPNsense wireless-edit privilege (PR:L - not an anonymous attacker), and (2) a wireless interface configured for WPA where the operator-controlled fields wpa.identity, wpa.passphrase, or RADIUS auth_server_shared_secret/auth_server_shared_secret2 are written into configuration consumed by the root-run wpa_supplicant or hostapd daemons. The attacker injects CR/LF (newline) characters into those fields to append arbitrary daemon directives. Limiting factors: it is post-authentication and role-gated, depends on a wireless/WPA deployment actually being present and the config being (re)loaded by the daemon, and the CVSS AC:H/AT:P indicate the trigger is not trivially reliable. Confidentiality is unaffected; impact is to integrity and availability of the root-run wireless daemons.

This is a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N, VC:N/VI:H/VA:H) and score of 6.1 (medium) tell a consistent story: network-reachable via the web UI, but gated behind an existing authenticated account holding the wireless-edit privilege (PR:L), with a non-trivial trigger (AC:H) and a required attack condition (AT:P). The impact is high to integrity and availability but none to confidentiality, matching a config-injection flaw whose injected directives run under root daemons. It is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was supplied in the input, so widespread-exploitation probability cannot be quantified here. The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with the low-privilege-required, authenticated nature of the flaw. The main gap between raw severity and real risk is the PR:L precondition plus the need for a wireless interface using WPA - this is an insider / post-authentication escalation primitive (low-priv operator to root-context directive injection), not a remote unauthenticated takeover. A VulnCheck advisory and an independent research writeup exist and the trigger is well understood from the vendor fix, so this should be patched on a normal prioritized schedule.

An authenticated OPNsense user who holds the wireless-edit privilege edits a wireless interface and embeds a CR/LF sequence inside wpa.identity, wpa.passphrase, or a RADIUS shared-secret field, appending attacker-chosen wpa_supplicant or hostapd configuration directives. When the root-run supplicant/hostapd daemon reloads the generated configuration, the injected directives are parsed and act with root context. An independent research writeup (abraxaslabs) describes the technique; no confirmed working exploit code is identified in the provided input, and the AC:H/AT:P metrics indicate the attack is not a simple one-shot.