OPNsense EUVD-2026-30183

Exploitation requires network reach to the OPNsense XMLRPC endpoint (typically used for High Availability config synchronization or admin tooling) AND high-privilege credentials valid for that interface (CVSS PR:H) - practically, this means the system admin password or the HA sync password. No user interaction is required (UI:N) and complexity is low (AC:L) once the attacker can authenticate. The specific entry point is the opnsense.restore_config_section XMLRPC method, so deployments that do not expose XMLRPC to untrusted networks and have not had sync/admin credentials compromised are significantly less reachable; only OPNsense core versions strictly below 26.1.7 are vulnerable.

Risk signals are mixed and should be weighed carefully. CVSS 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects severe technical impact with low attack complexity over the network, but PR:H means the attacker must already hold high privileges on the XMLRPC interface - typically administrative or HA-sync credentials - which is a substantial gate. SSVC corroborates this with Exploitation=poc, Automatable=no, and Technical Impact=total: severe outcome on success but not a worm-grade mass-exploitation target. EPSS at 0.23% (46th percentile) is consistent with that picture, and the CVE is NOT on CISA KEV. Net: this is a serious post-authentication RCE that matters most where the XMLRPC sync endpoint or admin interface is reachable by attackers who already have credentials or have compromised an HA peer - prioritize patching where OPNsense is internet-exposed or where HA sync secrets may be at risk, but it is not a drop-everything emergency for well-segmented deployments.

An attacker who has obtained high-privilege credentials for the OPNsense admin or HA sync XMLRPC interface - for example via credential theft, a compromised HA peer, or a leaked sync password - sends a crafted XMLRPC call to opnsense.restore_config_section containing unsanitized payload fragments. The malformed configuration section is processed without proper neutralization and injects attacker-controlled arguments into a downstream command, yielding arbitrary OS-level code execution on the firewall (publicly available exploit code exists per SSVC poc rating).