OPNsense EUVD-2026-30184

The attacker must already possess valid OPNsense credentials for an account holding the user-management privilege (CVSS PR:H), and the local user synchronization flow that invokes core/src/opnsense/scripts/auth/sync_user.php must be reachable - this is a built-in management workflow, so the gating factor is the role, not a non-default feature. No end-user interaction is required (UI:N). Exploitation is limited to OPNsense core versions earlier than 26.1.8, and practical reach depends on whether the management interface is exposed beyond the trusted admin network; deployments that restrict user-management to a single root-equivalent administrator effectively remove the realistic attack surface.

Signals point to a high-impact but access-limited vulnerability. The CVSS 9.1 score is driven by network attack vector (AV:N), low complexity (AC:L), changed scope (S:C, escalation from user-manager role to root/OS), and total CIA impact - but PR:H makes successful exploitation contingent on first obtaining a high-privilege management account. EPSS at 0.13% (32nd percentile) is consistent with that gating, and SSVC's 'Automatable: no' aligns: exploitation requires an authenticated, privileged session, so worms or mass scanners are unlikely. SSVC 'Exploitation: poc' indicates publicly available exploit code exists, and 'Technical Impact: total' confirms full system compromise once reached. No KEV listing, no claims of in-the-wild abuse. Prioritize this for any OPNsense deployment where the management interface is multi-tenant, where user-management is delegated, or where the UI is exposed beyond a trusted admin network - in those cases the PR:H barrier is materially lower than it looks.

An attacker who has obtained credentials for an OPNsense account with user-management rights - through phishing of a junior admin, credential reuse, or insider abuse - logs into the web UI and creates or edits a local user, supplying an email address crafted to pass format validation while embedding a shell metacharacter sequence (for example, a payload using $() or backticks). When the backend invokes sync_user.php as root, the embedded command executes, giving the attacker arbitrary command execution as root on the firewall. Public POC code exists per SSVC, lowering the skill barrier for an attacker who already has a foothold.