CVE-2026-119409

HIGH 7.2

OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.

CWE	CWE-78
Vendor	opnsense
Product	core
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for opnsense core

Be the first to know when new high vulnerabilities affecting opnsense core are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

opnsense / core

0 < 26.7.8

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/opnsense/core/security/advisories/GHSA-p683-f7x2-pm4p github.com: https://github.com/opnsense/core/commit/1cc41fc39da99d59818c789b3b561f1515126f47 github.com: https://github.com/opnsense/core/commit/8e214533d33c3af7481e86f616ee615adc6a0a73 github.com: https://github.com/opnsense/update/commit/9bfd3b7020499b6032ee64804193a9f3ce8178fa github.com: https://github.com/opnsense/update/blob/a2b8a10ba85f13b2cd002abb4c8692dde99f0261/src/update/opnsense-update.sh.in#L165 abraxaslabs.tech: https://abraxaslabs.tech/research/opnsense-firmware-mirror-sed github.com: https://github.com/opnsense/core vulncheck.com: https://www.vulncheck.com/advisories/opnsense-before-26.7.8-root-command-injection-via-firmware-mirror-setting

Credits

Voidlet 🔍 Abraxas Labs Franco Fichtner