An XMLRPC method named opnsense.restore_config_section in OPNsense, a FreeBSD-based firewall platform, does not sanitize user supplied input. This allows an attacker to craft a request that is executed as code on the host, resulting in untrusted code execution. The weakness corresponds to CWE-88, identifying it as a flaw in the XML parser that can lead to code execution.

The affected vendor is OPNsense. The product in question is the core OPNsense platform. The vulnerability exists in all releases before version 26.1.7, which provides the first fix. Users running earlier releases are thus vulnerable.

The CVSS base score of 9.1 indicates a critical severity. No EPSS score is available, so the exploitation likelihood cannot be quantified from public data, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw resides in an XMLRPC endpoint, an attacker who can reach that service – for example through a management or public-facing connection – may be able to send crafted XML that is executed as system commands.