Executive brief
OPNsense is an open-source firewall and routing platform used to secure corporate and home networks. A security flaw in its configuration restoration process allows an authorized user with specific administrative privileges to execute malicious commands on the system. If exploited, an attacker could gain full control over the firewall, potentially leading to a complete network compromise or data theft.
Technical details
An argument injection vulnerability (CWE-88) exists in OPNsense prior to version 26.1.7 within the XMLRPC API. The 'opnsense.restore_config_section' method fails to sanitize various CLI parameters in the 'local_user_set' function located in 'etc/inc/auth.inc', specifically when handling user-related configuration data. An attacker with 'XMLRPC Library' privileges can submit a crafted XML request containing shell metacharacters in fields such as the username. When the configuration is subsequently synchronized or services are reloaded, the unsanitized input is passed to a shell command executed via 'popen()', resulting in remote code execution with root privileges. This vulnerability is addressed in version 26.1.7.
Affected products
- OPNsense OPNsense < 26.1.7
Timeline
- 2026-04-30: advisory: Original GitHub security advisory published
- 2026-05-13: disclosed: CVE-2026-44193 published to NVD
- 2026-05-13: patched: Fix confirmed in version 26.1.7