CVE-2026-45158

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la 26.1.8, la entrada de usuario no saneada se pasa a la configuración DHCP de la interfaz configurada, que es procesada por un script de shell, permitiendo la ejecución remota de código como root en el sistema operativo subyacente. Esta vulnerabilidad está corregida en la 26.1.8.

Information

Published : 2026-05-13 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-45158

Mitre link : CVE-2026-45158

CVE.ORG link : CVE-2026-45158

JSON object : View

Products Affected

opnsense

opnsense

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2026-45158", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45158", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T12:22:02.967181Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opnsense", "product": "core", "versions": [{"status": "affected", "version": "< 26.1.8"}]}]}], "published": "2026-05-13T22:16:46.363", "references": [{"url": "https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8."}, {"lang": "es", "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la 26.1.8, la entrada de usuario no saneada se pasa a la configuraci\u00f3n DHCP de la interfaz configurada, que es procesada por un script de shell, permitiendo la ejecuci\u00f3n remota de c\u00f3digo como root en el sistema operativo subyacente. Esta vulnerabilidad est\u00e1 corregida en la 26.1.8."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0EDE7AC-7C9D-4244-9120-DA3CDB7AAB2C", "versionEndExcluding": "26.1.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}