CVE-2026-45158: OPNsense: Command Injection via Attacker-Controlled DHCP Configuration

Overview

CVE-2026-45158 is a critical vulnerability in OPNsense, a firewall and routing platform based on FreeBSD. The advisory describes that unsanitized user input is passed to the DHCP configuration of a configured interface and handled by a shell script. The record associates the issue with CWE-88, which is listed as Argument Injection. The description and the classification should be read together when assessing the weakness.

Impact

The advisory states that the flaw can allow remote code execution as root on the underlying operating system. The record gives a CVSS base score of 9.1 with high confidentiality, integrity and availability impact, and the SSVC technical impact is recorded as total. The recorded vector indicates that high privileges are required and that user interaction is not needed.

Affected products and versions

• OPNsense Core: releases before 26.1.8, according to the affected entry in the record.
• The record lists a second product entry for OPNsense with the same threshold of before 26.1.8.
• The fixed version is 26.1.8, as stated in the description.
• The structured fixes field in the record is empty, so the fix version is taken from the description text.

Exploitation status

The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none and automatable as no. The EPSS probability is recorded as 0.00822 with a percentile of 0.56918.

Remediation and mitigation

• Upgrade OPNsense installations to 26.1.8 or a later release that includes the fix.
• Inventory all firewalls running OPNsense, including high availability pairs and lab systems, and prioritize those with interfaces that receive DHCP configuration from untrusted or semi-trusted administrators.
• Restrict administrative access to the web interface and management channels to trusted networks and accounts, and enforce strong authentication for administrators.
• Review who can modify interface and DHCP settings and remove unnecessary access.

Detection guidance

• Review configuration change logs for unexpected modifications to interface or DHCP settings.
• Monitor for unexpected processes, new accounts, or changes to system files on OPNsense appliances.
• Compare running firmware versions against the inventory to confirm that affected releases have been replaced.
• Consider forwarding firewall and system logs to a central location so that suspicious administrative activity can be investigated.

Limitations of the available information

The record does not provide detailed technical analysis of the vulnerable script or the exact conditions required for exploitation beyond what the description and vector state. The affected list uses only the threshold before 26.1.8, and the record does not confirm intermediate affected releases. The EPSS date in the record is later than the publication date and should be verified against the source. Information about exploitation outside the sources consulted is unknown.

Frequently asked questions

Which OPNsense versions are affected by CVE-2026-45158?

The record states that versions before 26.1.8 are affected, and that 26.1.8 contains the fix.

Is CVE-2026-45158 known to be exploited in the wild?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Upgrade affected OPNsense installations to 26.1.8 or later, and restrict administrative access to trusted networks and accounts while planning the update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.