CVE-2026-45158

Published May 13, 2026

Last updated 5 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-45158 is a remote code execution vulnerability identified in OPNsense, a FreeBSD-based firewall and routing platform. This flaw stems from unsanitized user input being passed to the DHCP configuration of a configured interface. A shell script then processes this input, allowing for command injection. An authenticated attacker with high privileges can exploit this vulnerability by injecting shell commands through the DHCP input, leading to the execution of arbitrary code as root on the underlying operating system. The issue is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command) and affects OPNsense versions prior to 26.1.8, where the vendor has addressed the vulnerability.

Description: OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.
Source: security-advisories@github.com
NVD status: Analyzed
Products: opnsense

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 6
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-88

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A0EDE7AC-7C9D-4244-9120-DA3CDB7AAB2C",
            "versionEndExcluding": "26.1.8",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.