OPNsense EUVD-2026-30202

Exploitation requires (1) authenticated access to the OPNsense web GUI with privileges sufficient to edit DHCP configuration on an interface (PR:H in the CVSS vector), (2) the target running OPNsense core prior to 26.1.8 with DHCP service enabled on at least one configurable interface so the vulnerable shell-script processing path is reached, and (3) network reachability to the web management interface (AV:N). No user interaction by a second party is needed (UI:N). The principal limiting factor is the high-privilege prerequisite: in deployments where the admin UI is restricted to an internal management network and admin accounts are tightly controlled with MFA, the realistic attack surface is small and is mostly insider misuse or post-compromise privilege chaining rather than direct external exploitation.

Signals are mixed. CVSS 9.1 is driven primarily by the scope change (S:C) and total CIA impact when shell access as root is achieved - but the same vector specifies PR:H, meaning the attacker must already hold high privileges (an administrative session capable of editing DHCP interface configuration). That sharply narrows the realistic threat to insider misuse, post-auth pivoting after credential theft, or chained exploitation following an authentication bypass. SSVC reflects this nuance: Exploitation=none, Automatable=no, Technical Impact=total, which CISA's framework typically maps to a 'Track' rather than 'Act' decision. EPSS at 0.23% (46th percentile) and absence from CISA KEV are consistent with no observed exploitation. The high CVSS therefore overstates urgency relative to real-world risk for hardened deployments - but for any OPNsense instance where the admin UI is exposed beyond a trusted management network, or where lower-privilege admin roles can reach DHCP settings, this is a meaningful root-RCE primitive that should be patched promptly.

An attacker who has obtained valid administrator (or sufficiently privileged operator) credentials for the OPNsense web UI - for example via phishing of a network engineer, reused credentials, or post-compromise pivoting from a management host - navigates to the DHCP configuration page for an interface and enters a crafted value containing shell metacharacters into a field that is later concatenated into a backend shell script. When the configuration is applied, the script executes the injected command as root, giving the attacker a persistent root shell on the firewall itself, from which they can sniff traffic, alter NAT/firewall rules, or pivot deeper into protected segments. No public proof-of-concept has been identified, but the bug class (argument injection into a root-run shell script) is straightforward to weaponize once the vulnerable field is identified.