OPNsense EUVD-2026-30185

No special configuration is required beyond network reachability of the OPNsense authentication endpoint (web management UI or SSH). The CVSS vector PR:N confirms exploitation is unauthenticated. The vulnerability is present in the default OPNsense lockout_handler logic for all core versions prior to 26.1.7 and does not depend on any non-default feature being enabled. Exploitation is limited by two factors: (1) the attacker must be able to reach the authentication interface over the network - organizations that restrict management interface access to internal or trusted IP ranges are not exposed; and (2) successful exploitation of the lockout bypass alone does not grant access - the attacker must additionally succeed at credential guessing, meaning accounts protected by strong, unique passwords are not at direct risk from this flaw in isolation.

Despite a moderate CVSS base score of 5.3, the real-world risk to internet-facing OPNsense deployments is meaningfully elevated by several converging signals. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is fully remote, requires no privileges, no user interaction, and low complexity - characteristics that favor opportunistic automated attacks. SSVC classifies the attack as automatable with partial technical impact, and a public proof-of-concept exists (referenced gist at github.com/sopex). Critically, this vulnerability is not a standalone authentication bypass - its impact is as an enabler: by neutralizing the lockout control, it exposes the target to unbounded password guessing, which on weak or reused credentials could lead to full administrative compromise of the firewall. The EPSS score of 0.03% (10th percentile) is notably low given the POC existence and automatable classification, suggesting that mass exploitation has not been observed at the time of scoring - however, OPNsense is commonly deployed as an internet-edge device, and credential attacks against firewall management interfaces are a well-documented threat pattern. There is no conflict in the data signals, but the low EPSS should not be interpreted as low inherent risk for organizations with weak administrative credentials or externally exposed management interfaces.

An attacker identifies an internet-facing OPNsense firewall with its management web interface or SSH exposed. They initiate an automated credential-stuffing or dictionary attack, but between each failed login attempt, they submit a login request using a crafted username string such as 'Accepted' or 'Successful login', which causes the lockout_handler to reset the failure counter for the attacker's IP. A public proof-of-concept gist demonstrates this technique, enabling the attacker to cycle through password lists indefinitely without triggering the lockout threshold, ultimately achieving authentication if the target account uses a weak or previously breached password.