CVE-2026-119409highCWE-78

CVE-2026-119409: falha de alta gravidade em opnsense core

OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

Publicada em

Seguir esta CVE+ Monitorar core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 2.5%
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
opnsense · core
CVEs relacionadas — opnsense core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 5.7%CVE-2026-57155CRITICALOPNsense: Root RCE via Arbitrary File Write in GeoIP Alias ImporterEPSS 0.9%CVE-2026-53582HIGHOPNsense: XPATH Injection can disclose any secret in config.xmlEPSS 0.7%CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.7%CVE-2026-58390HIGHOPNsense: Stored XSS to root RCE via OpenVPN client common_name in status viewsEPSS 0.6%CVE-2026-45158CRITICALOPNsense: Command Injection via Attacker-Controlled DHCP ConfigEPSS 0.5%