Opnsense
Monthly
Command injection in OPNsense firmware management (fixed in 26.7.8 and 26.10) lets an authenticated user holding only the 'System: Firmware' privilege store a crafted firmware mirror URL through POST /api/core/firmware/set, which the backend later evaluates as shell code the next time firmware information is retrieved or the firmware WebUI page loads - resulting in arbitrary command execution with root privileges. A related sed-injection path lets the same restricted account disable package signature verification. The vendor advisory includes a full proof-of-concept reproduction on OPNsense Community Edition 26.7.7; a public PoC reference exists, it is not verified as working exploit code, and no active exploitation is confirmed at time of analysis.
Improper authorization handling in OPNsense core before 26.1.11 lets an authenticated low-privileged user (CVSS PR:L) bypass the user-config-readonly restriction and persist configuration changes through MVC APIs that rely on the throwReadOnly() guard. The flaw only triggers for accounts whose privileges are assigned directly: when a user is given both a component write privilege and user-config-readonly inside one comma-separated <priv> value, ACL::hasPrivilege() fails to detect the read-only flag through its exact string comparison, so the write is allowed; accounts receiving privileges through groups are unaffected. Impact is confined to configuration integrity for the affected component (I:H with C:N and A:L), no public exploit has been identified at time of analysis, and the vendor has shipped the fix in OPNsense 26.1.11.
Unauthenticated log injection in the OPNsense WebGUI login handler lets a network-adjacent attacker forge authentication events that manipulate the firewall's sshlockout protection state. Because the usernamefld parameter prior to version 26.1.11 passes carriage-return and line-feed characters through LOG_AUTH into the syslog-ng lockout pipeline, an attacker who can reach the login page can plant a fabricated failure event naming a victim IP, causing that address to be added to the sshlockout PF table and its active states killed, or plant a forged accepted event to reset their own brute-force counter and defeat password-guessing lockout. The flaw requires no authentication and no user interaction, but the assessed AV:A vector means exploitation presumes adjacency or management-network reachability to the GUI; impact is integrity of lockout state and availability of blocked systems (administrative, DNS, gateway, or monitoring addresses), with no confidentiality impact, and no public exploit or confirmed in-the-wild activity was identified at time of analysis.
Stored cross-site scripting in the OPNsense OpenVPN connection-status dashboard widget and status view lets an authenticated VPN client execute arbitrary JavaScript inside a firewall administrator's browser session, which the advisory demonstrates can read config.xml, invoke privileged APIs, reset the root password and ultimately obtain root command execution on the appliance. Exploitation is heavily gated: the OpenVPN server must be configured with username-as-common-name and a RADIUS or LDAP authentication backend, the attacker must be able to provision or self-register a backend username containing a double quote, a separate trust boundary must exist between the identity backend and the firewall (the local user database is unaffected because its username validator rejects quotes), and an administrator must open the affected dashboard or status page and trigger the injected handler - the demonstrated payload required pointer movement over the client row rather than unconditional page-load execution. Consistent with the CVSS vector (AV:N/AC:H/PR:L/UI:R) this is a low-privilege, high-complexity, admin-interaction-dependent issue; no public exploit code was identified at time of analysis, and the fix shipped in OPNsense 26.1.11.
Root-level code execution on OPNsense firewalls running versions prior to 26.1.11 is achievable by an authenticated operator who holds the 'Firewall Alias Edit' privilege and can point a GeoIP alias at an attacker-controlled source URL. The GeoIP importer's process_zip() and process_gzip() routines trust the CSV country_code field when building output filenames under /usr/local/share/GeoIP/alias, so a crafted value traverses out of that directory and writes attacker-controlled files as root; chaining a planted newsyslog fragment with an oversized log file then lets the default hourly root cron job execute the payload, yielding complete firewall compromise (CVSS 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation requires a non-default alias configuration that the operator must supply.
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
Remote code execution in OPNsense firewall (core versions prior to 26.1.8) allows authenticated administrators to execute arbitrary commands as root by injecting shell metacharacters into DHCP interface configuration fields that are passed unsanitized to an underlying shell script. The flaw carries a 9.1 CVSS score with scope change reflecting privilege escalation from the web UI context to OS root, though no public exploit has been identified at time of analysis and EPSS estimates only a 0.23% probability of near-term exploitation.
Authenticated remote code execution in OPNsense firewall versions prior to 26.1.8 allows a user with user-management privileges to execute arbitrary commands as root by smuggling shell payloads inside an email-address-formatted field processed by the local user synchronization script. Publicly available exploit code exists per SSVC, though EPSS scoring (0.13%) indicates low predicted mass exploitation; SSVC classifies technical impact as total but automation as no. No active exploitation has been confirmed in CISA KEV at time of analysis.
Remote code execution in OPNsense firewall versions prior to 26.1.7 allows authenticated high-privileged users to execute arbitrary code via the opnsense.restore_config_section XMLRPC method, which fails to sanitize user-supplied input. The flaw carries a CVSS 9.1 with scope change and total impact, and while publicly available exploit code exists per SSVC, EPSS rates real-world exploitation probability at only 0.23%, suggesting niche rather than mass-scale risk. The vendor has shipped a fix in 26.1.7 and the issue is tracked as GHSA-xxp9-93cr-x54p and EUVD-2026-30183.
LDAP filter injection in OPNsense firewall allows unauthenticated attackers to enumerate valid LDAP usernames and bypass group membership restrictions via the WebGUI login page. Affects OPNsense versions prior to 26.1.6. The vulnerability stems from failure to escape user-supplied input before insertion into LDAP search filters, enabling metacharacter injection. Attackers can authenticate as any LDAP user with known credentials, circumventing Extended Query group membership controls. No public exploit identified at time of analysis.
Authenticated OPNsense users holding the page-services-ntp-gps or PPS privilege can inject additional ntpd directives by submitting CR/LF characters in the fudge and refid fields of services_ntpd_gps.php or services_ntpd_pps.php, causing the generated /var/etc/ntpd.conf to be loaded by the root-run NTP daemon. OPNsense core through 26.7.8 is affected, and exploitation requires both the delegated NTP GPS/PPS privilege and an apply/restart of the NTP service, so this is a medium-severity privilege-boundary bypass rather than an unauthenticated mass-exploitable flaw. No CISA KEV entry or EPSS score was supplied, a public research write-up is referenced, working exploit code for this specific NTP vector is not confirmed in the provided data, and the vuln.today priority is this_month.
Captive portal session takeover in OPNsense core allows an unauthenticated attacker sharing a Layer-2 segment with portal clients to inherit an already authorized victim session by forging gratuitous ARP replies that claim the attacker's own IP address belongs to the victim's MAC. The flaw only matters where captive portal roaming is enabled on the zone and a legitimate authorized session already exists; the demonstrated outcome is unauthorized reuse of that existing session, with traffic and quota attributed to the victim, rather than creation of a session from nothing. Severity is moderate (CVSS 5.3; assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), there is no CISA KEV listing, but a public vendor advisory and an independent technical write-up with reproduction steps are available, and fixes are published in OPNsense 26.7.3 and 26.4.2p1.
Configuration line injection in OPNsense core before 26.7.8 lets an authenticated account holding the wireless-edit privilege embed CR/LF characters in WPA fields - wpa.identity, wpa.passphrase, and the RADIUS auth_server_shared_secret/auth_server_shared_secret2 values - so that arbitrary wpa_supplicant or hostapd directives are appended when the generated configuration is loaded by the root-run wireless daemons. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects a post-authentication, role-gated issue whose trigger additionally depends on a wireless interface actually being configured for WPA and the configuration being consumed by the daemon; confidentiality is unaffected while integrity and availability of the wireless service are. This is a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency: no CISA KEV listing and no confirmed working exploit code were reported at time of analysis, although a public research writeup and the upstream fix commits describe the injection technique, and the vendor has released a patch in 26.7.8.
Unauthenticated CRLF injection in OPNsense's WebGUI login form lets a remote attacker forge syslog lines that the always-on lockout_handler parses as genuine authentication failures, causing attacker-chosen IP addresses to be added to the sshlockout pf table and their active pf states to be killed - disrupting management access, DNS, WAN or monitoring connectivity. A second variant injects forged 'Accepted' entries to reset the brute-force counter for an attacking host, enabling continued password guessing. The flaw affects OPNsense core before 26.7.8 (with backported fixes on the 26.1 and 26.4 branches), is reachable against a default install with only HTTP access to /index.php plus a CSRF token, and is scored 6.9 under CVSS 4.0 by the vendor (our assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact). It is not listed in CISA KEV and no active exploitation is confirmed, though the vendor advisory publishes a lab-tested proof-of-concept payload.
Stored and reflected cross-site scripting in OPNsense Firewall 26.7.1_1 and earlier lets an authenticated low-privileged GUI user execute JavaScript in another user's browser, including a root user's session, when the victim views the Dashboard, Interfaces → Overview, or submits a crafted Firewall → Log Files → Live View search. The stored variant requires write access to the Interfaces → Assignments Description field, while the reflected variant requires the victim to interact with the Live View search; both require valid GUI credentials and victim interaction. The issue is rated CVSS 5.6, no KEV status was provided, and a public PoC reference exists but is not verified as working exploit code.
Stored cross-site scripting in OPNsense core prior to 26.1.11 lets a user who holds the page-system-certmanager privilege inject HTML metacharacters into a certificate description field, and that markup is later rendered unescaped in the SSL Certificate selector on System Settings > Administration, executing in the browser session of any other user who opens that page. Exploitation requires a multi-user deployment and deliberate victim interaction (CVSS 3.1 base 5.2, Medium; vendor vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N, with the independent assessment treating the impact as scope-changing and limited to low confidentiality/integrity), and the attacker must already be authenticated with a high-privilege account. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the flaw is resolved by upgrading to OPNsense 26.1.11.
Stored cross-site scripting in the NTP GPS configuration page of OPNsense (FreeBSD-based firewall/router platform) lets an authenticated user who holds the page-services-ntp-gps privilege persist a malicious initcmd value that closes the GPS textarea and injects script into the page. The payload executes in the browser session of any user - including an administrator - who later opens that page, letting the script read CSRF material and perform authenticated actions with the victim's privileges, which is why the CVSS vector assigns a changed scope (S:C). Affected are OPNsense core builds prior to 26.1.11; the flaw is fixed in 26.1.11, no public exploit was identified at time of analysis, and exploitation requires both a privileged operator account and a second user (UI:R) visiting the page.
Authenticated OPNsense users who hold at least one affected module privilege can supply a crafted safe-delete token that is interpolated into an XPath query over config.xml, letting them read configuration metadata from modules they are not authorized to access. The flaw, tracked as CVE-2026-58395, affects OPNsense releases prior to 26.1.11 and yields a substring-presence oracle that leaks configuration item names, descriptions, reference paths, and UUIDs, though it cannot modify configuration or delete data. It is a read-only information-disclosure issue rated 4.3 medium; no public exploit code identified at time of analysis, and CISA KEV does not list it.
A path traversal in OPNsense's OpenVPN Client Specific Override (CSO) handling allows an authenticated user holding CSO privileges to store a traversal sequence such as '../' in the common_name field, which openvpn_csc_conf_write() concatenates into the target path /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check; when a matching OpenVPN client-connect or authentication event is later processed by client_connect.php or user_pass_verify.php, a generated CSO configuration file is written outside the intended directory. Exploitation is constrained: the attacker must first have operator-level CSO access and must cause a matching common name or username to be processed, and the written content is generated OpenVPN configuration rather than arbitrary attacker-controlled bytes, which limits achievable impact - there is no public exploit identified at time of analysis. The issue is rated medium severity (vendor CVSS 5.9, independent assessment CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) and is fixed in OPNsense 26.1.11.
Stored cross-site scripting in OPNsense core before 26.1.11 allows a user holding Firewall Categories or Firewall Alias Edit privileges to plant script that executes in the browser session of an administrator or other operator who opens the Firewall Rules or NAT page. The injected code runs with the victim's context, can read CSRF tokens, and can therefore perform authenticated actions on the firewall as that victim. Exploitation is not anonymous - it requires the attacker to already possess category or alias editing rights (PR:L, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), and the malicious category must be attached to a rule or the alias referenced as a rule source/destination and saved so the tooltip renders; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited in CISA KEV. Fixed in OPNsense 26.1.11.
Stored cross-site scripting in OPNsense before 26.1.9 allows any authenticated user with certificate management access to plant a persistent JavaScript payload via the trust certificate API's description field. Once stored, the payload executes in the browser of every authenticated user who opens the Dashboard, because Certificates.js interpolates the raw description directly into an HTML attribute template literal without output encoding. No active exploitation has been confirmed (not in CISA KEV), and a vendor-released patch is available as of OPNsense 26.1.9.
Stored cross-site scripting in OPNsense before 26.1.9 allows low-privileged authenticated attackers holding firewall rule management rights to inject arbitrary JavaScript into rule description fields via the filter API, which then executes in any authenticated administrator's browser when the Firewall Rules page is loaded. Impact is limited to subsequent-system effects - session hijacking or credential theft targeting other authenticated users - rather than direct host compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in OPNsense 26.1.9 as of June 2, 2026.
Brute-force lockout bypass in OPNsense prior to 26.1.7 allows unauthenticated remote attackers to indefinitely circumvent the authentication failure counter, enabling unlimited credential guessing against any network-accessible login endpoint. The flaw resides in the lockout_handler logic, which interprets attacker-controlled username strings containing the keywords 'Accepted' or 'Successful login' as success signals and resets the IP-based failure counter. A publicly available proof-of-concept exploit exists (SSVC exploitation: poc), the attack is classified as automatable with no prerequisites beyond network reach, and no active exploitation is confirmed in CISA KEV. EPSS is low at 0.03% (10th percentile), suggesting limited observed exploitation at time of analysis.
OPNsense prior to version 26.1.4 contains a CSRF vulnerability where state-changing API endpoints accept HTTP GET requests without proper anti-CSRF protections, allowing authenticated users to be tricked into triggering unintended system operations. An attacker can craft a malicious website that, when visited by an authenticated OPNsense administrator, performs unauthorized configuration changes or service reloads through the vulnerable endpoints. No patch is currently available for this medium-severity vulnerability affecting OPNsense firewall deployments.
OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. [CVSS 5.4 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter. [CVSS 6.4 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. [CVSS 6.4 MEDIUM]
OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDrive_GDriveEmail, GDrive_GDriveFolderID, GDrive_GDriveBackupCount, Nextcloud_url, Nextcloud_user, Nextcloud_password, Nextcloud_password_encryption, and Nextcloud_backupdir. [CVSS 5.4 MEDIUM]
A path-traversal flaw in Deciso OPNsense's diag_backup.php configuration backup/restore handler lets an administrator-level user supply a crafted backup filename that is used in file operations without validation, allowing arbitrary file creation with root privileges outside the intended /conf/backup and /var/db/rrd directories. The attack surface is limited: the CVSS vector (AV:A/PR:H/UI:N) and the vendor description both require a valid high-privilege web GUI session plus network-adjacent access to the management interface, so a remote unauthenticated attacker cannot reach it directly. Impact is integrity-only (no confidentiality or availability loss), EPSS is low at 0.61% (48th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; an upstream fix commit exists in the opnsense/core repository and ZDI tracks the issue as ZDI-25-1022 / ZDI-CAN-28133.
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Command injection in OPNsense firmware management (fixed in 26.7.8 and 26.10) lets an authenticated user holding only the 'System: Firmware' privilege store a crafted firmware mirror URL through POST /api/core/firmware/set, which the backend later evaluates as shell code the next time firmware information is retrieved or the firmware WebUI page loads - resulting in arbitrary command execution with root privileges. A related sed-injection path lets the same restricted account disable package signature verification. The vendor advisory includes a full proof-of-concept reproduction on OPNsense Community Edition 26.7.7; a public PoC reference exists, it is not verified as working exploit code, and no active exploitation is confirmed at time of analysis.
Improper authorization handling in OPNsense core before 26.1.11 lets an authenticated low-privileged user (CVSS PR:L) bypass the user-config-readonly restriction and persist configuration changes through MVC APIs that rely on the throwReadOnly() guard. The flaw only triggers for accounts whose privileges are assigned directly: when a user is given both a component write privilege and user-config-readonly inside one comma-separated <priv> value, ACL::hasPrivilege() fails to detect the read-only flag through its exact string comparison, so the write is allowed; accounts receiving privileges through groups are unaffected. Impact is confined to configuration integrity for the affected component (I:H with C:N and A:L), no public exploit has been identified at time of analysis, and the vendor has shipped the fix in OPNsense 26.1.11.
Unauthenticated log injection in the OPNsense WebGUI login handler lets a network-adjacent attacker forge authentication events that manipulate the firewall's sshlockout protection state. Because the usernamefld parameter prior to version 26.1.11 passes carriage-return and line-feed characters through LOG_AUTH into the syslog-ng lockout pipeline, an attacker who can reach the login page can plant a fabricated failure event naming a victim IP, causing that address to be added to the sshlockout PF table and its active states killed, or plant a forged accepted event to reset their own brute-force counter and defeat password-guessing lockout. The flaw requires no authentication and no user interaction, but the assessed AV:A vector means exploitation presumes adjacency or management-network reachability to the GUI; impact is integrity of lockout state and availability of blocked systems (administrative, DNS, gateway, or monitoring addresses), with no confidentiality impact, and no public exploit or confirmed in-the-wild activity was identified at time of analysis.
Stored cross-site scripting in the OPNsense OpenVPN connection-status dashboard widget and status view lets an authenticated VPN client execute arbitrary JavaScript inside a firewall administrator's browser session, which the advisory demonstrates can read config.xml, invoke privileged APIs, reset the root password and ultimately obtain root command execution on the appliance. Exploitation is heavily gated: the OpenVPN server must be configured with username-as-common-name and a RADIUS or LDAP authentication backend, the attacker must be able to provision or self-register a backend username containing a double quote, a separate trust boundary must exist between the identity backend and the firewall (the local user database is unaffected because its username validator rejects quotes), and an administrator must open the affected dashboard or status page and trigger the injected handler - the demonstrated payload required pointer movement over the client row rather than unconditional page-load execution. Consistent with the CVSS vector (AV:N/AC:H/PR:L/UI:R) this is a low-privilege, high-complexity, admin-interaction-dependent issue; no public exploit code was identified at time of analysis, and the fix shipped in OPNsense 26.1.11.
Root-level code execution on OPNsense firewalls running versions prior to 26.1.11 is achievable by an authenticated operator who holds the 'Firewall Alias Edit' privilege and can point a GeoIP alias at an attacker-controlled source URL. The GeoIP importer's process_zip() and process_gzip() routines trust the CSV country_code field when building output filenames under /usr/local/share/GeoIP/alias, so a crafted value traverses out of that directory and writes attacker-controlled files as root; chaining a planted newsyslog fragment with an oversized log file then lets the default hourly root cron job execute the payload, yielding complete firewall compromise (CVSS 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). No public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation requires a non-default alias configuration that the operator must supply.
Authenticated XPath injection in the OPNsense firewall and routing platform (all versions prior to 26.1.10) lets a user holding CA Manager or Certificate Manager privileges recover values stored in config.xml character by character. The Trust module stores attacker-controlled certificate and CA refid values and interpolates them unescaped into XPath queries in CAsField.php and CertificatesField.php; because the resulting refcount/in_use boolean is returned to the requester, it acts as a blind injection oracle for secrets such as password hashes, API credentials, certificate private keys, VPN key material, and high-availability credentials, which in turn can enable privilege escalation and compromise of other security domains. Exploitation is post-authentication, requires those specific trust-management privileges, and is high-complexity and iterative (roughly one boolean leak per request), so this is a genuine but second-tier information-disclosure issue rather than a drive-by remote compromise; no public exploit code has been identified at time of analysis. Vendor-released patch: 26.1.10.
Remote code execution in OPNsense firewall (core versions prior to 26.1.8) allows authenticated administrators to execute arbitrary commands as root by injecting shell metacharacters into DHCP interface configuration fields that are passed unsanitized to an underlying shell script. The flaw carries a 9.1 CVSS score with scope change reflecting privilege escalation from the web UI context to OS root, though no public exploit has been identified at time of analysis and EPSS estimates only a 0.23% probability of near-term exploitation.
Authenticated remote code execution in OPNsense firewall versions prior to 26.1.8 allows a user with user-management privileges to execute arbitrary commands as root by smuggling shell payloads inside an email-address-formatted field processed by the local user synchronization script. Publicly available exploit code exists per SSVC, though EPSS scoring (0.13%) indicates low predicted mass exploitation; SSVC classifies technical impact as total but automation as no. No active exploitation has been confirmed in CISA KEV at time of analysis.
Remote code execution in OPNsense firewall versions prior to 26.1.7 allows authenticated high-privileged users to execute arbitrary code via the opnsense.restore_config_section XMLRPC method, which fails to sanitize user-supplied input. The flaw carries a CVSS 9.1 with scope change and total impact, and while publicly available exploit code exists per SSVC, EPSS rates real-world exploitation probability at only 0.23%, suggesting niche rather than mass-scale risk. The vendor has shipped a fix in 26.1.7 and the issue is tracked as GHSA-xxp9-93cr-x54p and EUVD-2026-30183.
LDAP filter injection in OPNsense firewall allows unauthenticated attackers to enumerate valid LDAP usernames and bypass group membership restrictions via the WebGUI login page. Affects OPNsense versions prior to 26.1.6. The vulnerability stems from failure to escape user-supplied input before insertion into LDAP search filters, enabling metacharacter injection. Attackers can authenticate as any LDAP user with known credentials, circumventing Extended Query group membership controls. No public exploit identified at time of analysis.
Authenticated OPNsense users holding the page-services-ntp-gps or PPS privilege can inject additional ntpd directives by submitting CR/LF characters in the fudge and refid fields of services_ntpd_gps.php or services_ntpd_pps.php, causing the generated /var/etc/ntpd.conf to be loaded by the root-run NTP daemon. OPNsense core through 26.7.8 is affected, and exploitation requires both the delegated NTP GPS/PPS privilege and an apply/restart of the NTP service, so this is a medium-severity privilege-boundary bypass rather than an unauthenticated mass-exploitable flaw. No CISA KEV entry or EPSS score was supplied, a public research write-up is referenced, working exploit code for this specific NTP vector is not confirmed in the provided data, and the vuln.today priority is this_month.
Captive portal session takeover in OPNsense core allows an unauthenticated attacker sharing a Layer-2 segment with portal clients to inherit an already authorized victim session by forging gratuitous ARP replies that claim the attacker's own IP address belongs to the victim's MAC. The flaw only matters where captive portal roaming is enabled on the zone and a legitimate authorized session already exists; the demonstrated outcome is unauthorized reuse of that existing session, with traffic and quota attributed to the victim, rather than creation of a session from nothing. Severity is moderate (CVSS 5.3; assessed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), there is no CISA KEV listing, but a public vendor advisory and an independent technical write-up with reproduction steps are available, and fixes are published in OPNsense 26.7.3 and 26.4.2p1.
Configuration line injection in OPNsense core before 26.7.8 lets an authenticated account holding the wireless-edit privilege embed CR/LF characters in WPA fields - wpa.identity, wpa.passphrase, and the RADIUS auth_server_shared_secret/auth_server_shared_secret2 values - so that arbitrary wpa_supplicant or hostapd directives are appended when the generated configuration is loaded by the root-run wireless daemons. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects a post-authentication, role-gated issue whose trigger additionally depends on a wireless interface actually being configured for WPA and the configuration being consumed by the daemon; confidentiality is unaffected while integrity and availability of the wireless service are. This is a genuine but conditional privilege-escalation issue rather than a mass-exploitation emergency: no CISA KEV listing and no confirmed working exploit code were reported at time of analysis, although a public research writeup and the upstream fix commits describe the injection technique, and the vendor has released a patch in 26.7.8.
Unauthenticated CRLF injection in OPNsense's WebGUI login form lets a remote attacker forge syslog lines that the always-on lockout_handler parses as genuine authentication failures, causing attacker-chosen IP addresses to be added to the sshlockout pf table and their active pf states to be killed - disrupting management access, DNS, WAN or monitoring connectivity. A second variant injects forged 'Accepted' entries to reset the brute-force counter for an attacking host, enabling continued password guessing. The flaw affects OPNsense core before 26.7.8 (with backported fixes on the 26.1 and 26.4 branches), is reachable against a default install with only HTTP access to /index.php plus a CSRF token, and is scored 6.9 under CVSS 4.0 by the vendor (our assessment: CVSS 3.1 AV:N/AC:L/PR:N/UI:N, availability-only impact). It is not listed in CISA KEV and no active exploitation is confirmed, though the vendor advisory publishes a lab-tested proof-of-concept payload.
Stored and reflected cross-site scripting in OPNsense Firewall 26.7.1_1 and earlier lets an authenticated low-privileged GUI user execute JavaScript in another user's browser, including a root user's session, when the victim views the Dashboard, Interfaces → Overview, or submits a crafted Firewall → Log Files → Live View search. The stored variant requires write access to the Interfaces → Assignments Description field, while the reflected variant requires the victim to interact with the Live View search; both require valid GUI credentials and victim interaction. The issue is rated CVSS 5.6, no KEV status was provided, and a public PoC reference exists but is not verified as working exploit code.
Stored cross-site scripting in OPNsense core prior to 26.1.11 lets a user who holds the page-system-certmanager privilege inject HTML metacharacters into a certificate description field, and that markup is later rendered unescaped in the SSL Certificate selector on System Settings > Administration, executing in the browser session of any other user who opens that page. Exploitation requires a multi-user deployment and deliberate victim interaction (CVSS 3.1 base 5.2, Medium; vendor vector AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N, with the independent assessment treating the impact as scope-changing and limited to low confidentiality/integrity), and the attacker must already be authenticated with a high-privilege account. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the flaw is resolved by upgrading to OPNsense 26.1.11.
Stored cross-site scripting in the NTP GPS configuration page of OPNsense (FreeBSD-based firewall/router platform) lets an authenticated user who holds the page-services-ntp-gps privilege persist a malicious initcmd value that closes the GPS textarea and injects script into the page. The payload executes in the browser session of any user - including an administrator - who later opens that page, letting the script read CSRF material and perform authenticated actions with the victim's privileges, which is why the CVSS vector assigns a changed scope (S:C). Affected are OPNsense core builds prior to 26.1.11; the flaw is fixed in 26.1.11, no public exploit was identified at time of analysis, and exploitation requires both a privileged operator account and a second user (UI:R) visiting the page.
Authenticated OPNsense users who hold at least one affected module privilege can supply a crafted safe-delete token that is interpolated into an XPath query over config.xml, letting them read configuration metadata from modules they are not authorized to access. The flaw, tracked as CVE-2026-58395, affects OPNsense releases prior to 26.1.11 and yields a substring-presence oracle that leaks configuration item names, descriptions, reference paths, and UUIDs, though it cannot modify configuration or delete data. It is a read-only information-disclosure issue rated 4.3 medium; no public exploit code identified at time of analysis, and CISA KEV does not list it.
A path traversal in OPNsense's OpenVPN Client Specific Override (CSO) handling allows an authenticated user holding CSO privileges to store a traversal sequence such as '../' in the common_name field, which openvpn_csc_conf_write() concatenates into the target path /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check; when a matching OpenVPN client-connect or authentication event is later processed by client_connect.php or user_pass_verify.php, a generated CSO configuration file is written outside the intended directory. Exploitation is constrained: the attacker must first have operator-level CSO access and must cause a matching common name or username to be processed, and the written content is generated OpenVPN configuration rather than arbitrary attacker-controlled bytes, which limits achievable impact - there is no public exploit identified at time of analysis. The issue is rated medium severity (vendor CVSS 5.9, independent assessment CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) and is fixed in OPNsense 26.1.11.
Stored cross-site scripting in OPNsense core before 26.1.11 allows a user holding Firewall Categories or Firewall Alias Edit privileges to plant script that executes in the browser session of an administrator or other operator who opens the Firewall Rules or NAT page. The injected code runs with the victim's context, can read CSRF tokens, and can therefore perform authenticated actions on the firewall as that victim. Exploitation is not anonymous - it requires the attacker to already possess category or alias editing rights (PR:L, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4), and the malicious category must be attached to a rule or the alias referenced as a rule source/destination and saved so the tooltip renders; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited in CISA KEV. Fixed in OPNsense 26.1.11.
Stored cross-site scripting in OPNsense before 26.1.9 allows any authenticated user with certificate management access to plant a persistent JavaScript payload via the trust certificate API's description field. Once stored, the payload executes in the browser of every authenticated user who opens the Dashboard, because Certificates.js interpolates the raw description directly into an HTML attribute template literal without output encoding. No active exploitation has been confirmed (not in CISA KEV), and a vendor-released patch is available as of OPNsense 26.1.9.
Stored cross-site scripting in OPNsense before 26.1.9 allows low-privileged authenticated attackers holding firewall rule management rights to inject arbitrary JavaScript into rule description fields via the filter API, which then executes in any authenticated administrator's browser when the Firewall Rules page is loaded. Impact is limited to subsequent-system effects - session hijacking or credential theft targeting other authenticated users - rather than direct host compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in OPNsense 26.1.9 as of June 2, 2026.
Brute-force lockout bypass in OPNsense prior to 26.1.7 allows unauthenticated remote attackers to indefinitely circumvent the authentication failure counter, enabling unlimited credential guessing against any network-accessible login endpoint. The flaw resides in the lockout_handler logic, which interprets attacker-controlled username strings containing the keywords 'Accepted' or 'Successful login' as success signals and resets the IP-based failure counter. A publicly available proof-of-concept exploit exists (SSVC exploitation: poc), the attack is classified as automatable with no prerequisites beyond network reach, and no active exploitation is confirmed in CISA KEV. EPSS is low at 0.03% (10th percentile), suggesting limited observed exploitation at time of analysis.
OPNsense prior to version 26.1.4 contains a CSRF vulnerability where state-changing API endpoints accept HTTP GET requests without proper anti-CSRF protections, allowing authenticated users to be tricked into triggering unintended system operations. An attacker can craft a malicious website that, when visited by an authenticated OPNsense administrator, performs unauthorized configuration changes or service reloads through the vulnerable endpoints. No patch is currently available for this medium-severity vulnerability affecting OPNsense firewall deployments.
OPNsense 19.1 contains a reflected cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject malicious scripts via the value parameter. [CVSS 5.4 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted payloads through the ignoreLogACL parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the mailserver parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting the passthrough_networks parameter in vpn_ipsec_settings.php. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter. [CVSS 6.4 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. [CVSS 6.1 MEDIUM]
OPNsense 19.1 contains a stored cross-site scripting vulnerability in the system_advanced_sysctl.php endpoint that allows attackers to inject persistent malicious scripts via the tunable parameter. [CVSS 6.4 MEDIUM]
OPNsense 19.1 contains multiple cross-site scripting vulnerabilities in the diag_backup.php endpoint that allow attackers to inject malicious scripts through multiple parameters including GDrive_GDriveEmail, GDrive_GDriveFolderID, GDrive_GDriveBackupCount, Nextcloud_url, Nextcloud_user, Nextcloud_password, Nextcloud_password_encryption, and Nextcloud_backupdir. [CVSS 5.4 MEDIUM]
A path-traversal flaw in Deciso OPNsense's diag_backup.php configuration backup/restore handler lets an administrator-level user supply a crafted backup filename that is used in file operations without validation, allowing arbitrary file creation with root privileges outside the intended /conf/backup and /var/db/rrd directories. The attack surface is limited: the CVSS vector (AV:A/PR:H/UI:N) and the vendor description both require a valid high-privilege web GUI session plus network-adjacent access to the management interface, so a remote unauthenticated attacker cannot reach it directly. Impact is integrity-only (no confidentiality or availability loss), EPSS is low at 0.61% (48th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; an upstream fix commit exists in the opnsense/core repository and ZDI tracks the issue as ZDI-25-1022 / ZDI-CAN-28133.
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles input sanitization. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.