The vulnerability in OPNsense before 26.7.8 is a command injection flaw that arises when an authenticated user with System: Firmware privileges sets a firmware mirror URL through the POST /api/core/firmware/set endpoint. The backend opnsense-update script evaluates the submitted URL with eval, allowing an attacker to embed shell metacharacters and arbitrary commands. Because the evaluation runs as root and can also manipulate signature verification with sed replacement, an attacker can execute any shell commands with full system privileges, potentially pivoting to complete control of the firewall device.

Affected vendor and product are OPNsense core. All releases prior to 26.7.8 are vulnerable, including 26.6.x, 25.x, and earlier. Specific affected version information is not enumerated beyond the general pre-26.7.8 threshold. The vulnerability is documented for deployments where API access is permitted and firmware updates are enabled.

The flaw carries a CVSS score of 8.6, classifying it as a high severity vulnerability. The dedicated EPSS score is not published, and the vulnerability is not in CISA's KEV catalog. Exploitation requires an authenticated session with System: Firmware privilege, meaning an attacker must have at least local administrative access or compromise legitimate credentials. Based on the description, the likely attack vector is a remote API request from an authenticated user, making the risk high for compromised or publicly exposed OPNsense instances.