The vulnerability allows an authenticated user with wireless‑edit privilege to introduce CR/LF characters into WPA configuration fields such as wpa.identity, wpa.passphrase, or RADIUS shared secrets. By doing so, the user can append arbitrary directives to the wpa_supplicant or hostapd configuration files that are parsed by root‑run daemons. This injection can lead to execution of unintended commands or alteration of wireless behavior, compromising confidentiality, integrity, and availability of the system.

Devices running OPNsense core versions prior to 26.7.8 are affected. The vulnerability applies to all OPNsense installations that allow wireless configuration editing by privileged users, regardless of network topology or OS distribution.

The CVSS score of 6.1 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation. However, the required conditions—authenticated access with wireless‑edit rights—are commonly granted to administrators, making the threat credible. Successful exploitation could result in arbitrary configuration changes or code execution at the root level.