Live › vulnerability › CVE-2026-119409
OPNsense before 26.7.8 lets a user with the System: Firmware privilege store a crafted firmware mirror URL that is evaluated by a shell update script. The attacker can execute commands as root and can disable package signature checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Any OPNsense firewall running a version before 26.7.8 where a user holds the System: Firmware privilege. Exposure depends on who can log in to the firewall administration interface, so limit that privilege to trusted administrators until the update is applied.
No product ranges from the sources yet.
opnsense-version.26.7.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
This page as .md · .json · in your agent: get_signal("CVE-2026-119409")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.