Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119409— OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

Quick assessment

Affected

opnsense core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OPNsense 26.7.8 之前的版本存在命令注入漏洞。拥有"System: Firmware"权限的已认证攻击者可以通过存储恶意的固件镜像 URL，以 root 身份执行任意命令。攻击者可通过接口提交 Shell 元字符，这些字符会被通过函数执行；此外，攻击者还能通过注入禁用软件包签名验证。

CVSS 7.2 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

Source: CVE Program / CVE List V5

Vulnerability Description

OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POST /api/core/firmware/set that opnsense-update evaluates with eval, and can also disable package signature verification through sed injection.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
opnsense	core	0 ~ 26.7.8	-

II. Public POCs for CVE-2026-119409

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119409

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-119409 (3)

Vendor Advisories for CVE-2026-119409 (2)

Security Blog Posts for CVE-2026-119409 (1)

🔗 OPNsense firmware mirror sed-skips pkg fingerprints · Abraxas Labs Read full article third-party-advisory

Vendor Pages for CVE-2026-119409 (1)

🔗 GitHub - opnsense/core: OPNsense GUI, API and systems backend · GitHub product

https://www.cve.org/CVERecord?id=CVE-2026-119409

Same Patch Batch · opnsense · 2026-10-30 · 5 CVEs total

CVE-2026-119424	6.8 MEDIUM	OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
CVE-2026-119560	5.9 MEDIUM	OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
CVE-2026-119425	5.4 MEDIUM	OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
CVE-2026-119423	5.3 MEDIUM	OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

IV. Related Vulnerabilities

Same product: core

Same vendor: opnsense

Same weakness: CWE-78