CVE-2026-57155: fallo crítico en opnsense core
OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer
Publicada el
48Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 9.9epss 0.9%
de la publicación al arma0 días
Publicada en NVD15 oct
1ª PoC16 jul
probabilidad de explotación
0.9%top 42% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
opnsense · corePoCs públicas encontradas — 1
githubgithub.com/babyshen/CVE-2026-57155★ 0⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — opnsense core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.9%CVE-2026-45158CRITICALOPNsense: Command Injection via Attacker-Controlled DHCP ConfigEPSS 0.8%CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 0.8%CVE-2026-53582HIGHOPNsense: XPATH Injection can disclose any secret in config.xmlEPSS 0.7%CVE-2026-58390HIGHOPNsense: Stored XSS to root RCE via OpenVPN client common_name in status viewsEPSS 0.5%CVE-2026-34578HIGHOPNsense has an LDAP Injection via Unsanitized Username in AuthenticationEPSS 0.5%