PT-2026-40830 · Opnsense · Opnsense

Published 2026-05-13 · Updated 2026-05-23 · CVE-2026-45158

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.8

Description Unsanitized user input is passed to the DHCP configuration of the configured interface and subsequently processed by a shell script. This allows remote code execution as root on the underlying operating system.

Recommendations Update to version 26.1.8.

Fix

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2026-45158

Affected Products

Opnsense

References · 8

• https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45158 · Security Note
• https://twitter.com/CVEnew/status/2054709180020465912 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2054729155116499333 · Twitter Post
• https://twitter.com/Netlas_io/status/2055220392105816250 · Twitter Post
• https://t.me/netlas/567 · Telegram Post
• https://t.me/CVEtracker/53727 · Telegram Post
• https://twitter.com/integ_sec/status/2058159781538357416 · Twitter Post