CVE-2026-119409
Received Received - Intake

Authenticated Command Injection in OPNsense Firmware Update

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119409
EUVD
EUVD-2026-113793

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-119409 is a command injection vulnerability in OPNsense versions before 26.7.8. It allows authenticated users with the System: Firmware privilege to execute arbitrary commands as root by injecting shell metacharacters into the firmware mirror URL. The vulnerability occurs because the opnsense-update script evaluates the mirror URL using eval, enabling command execution. Attackers can also disable package signature verification through sed injection.

Detection Guidance

Check OPNsense versions before 26.7.8 for vulnerability. Inspect firmware mirror settings for unusual URLs or shell metacharacters. Review logs for POST requests to /api/core/firmware/set with suspicious payloads. Use commands like grep to search for eval usage in opnsense-update.sh.in or sed injections in configuration files.

Impact Analysis

This vulnerability allows attackers to execute commands with root privileges on the OPNsense system. This could lead to full system compromise, including reading sensitive files, modifying configurations, installing malicious software, disrupting services, or gaining persistent access. The attack requires only the System: Firmware privilege or a valid Local API key.

Compliance Impact

This vulnerability could severely impact compliance with GDPR, HIPAA, and other regulations. It allows unauthorized root access, potentially leading to data breaches, unauthorized data access, or system tampering. Such incidents may result in regulatory fines, legal liabilities, and reputational damage due to compromised security controls.

Mitigation Strategies

Upgrade OPNsense to version 26.7.8 or later immediately. Disable the System: Firmware privilege for non-admin users. Review and restrict mirror URL inputs to prevent command injection. Monitor for unauthorized changes to signature verification settings in OPNsense.conf.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart