An authenticated user with privileges to manage other users in OPNsense can inject arbitrary system commands through the user management interface. By submitting a payload that masquerades as a valid email address, the attacker bypasses input validation, causing the underlying operating system to execute shell commands. This flaw is an instance of OS Command Injection (CWE-78) and poses a complete compromise of the device, allowing full root-level control.

The vulnerability affects the OPNsense firewall and routing platform, specifically the core component before version 26.1.8. Users running any pre‑26.1.8 build of OPNsense are potentially exposed. The flaw resides in the local user synchronization script located in the path core/src/opnsense/scripts/auth/sync_user.php.

With a CVSS score of 9.1 the vulnerability is rated as critical, indicating a high impact if exploited. The EPSS score is not available, but the lack of listing in CISA KEV does not diminish the inherent risk. The exploit requires authentication and user‑management rights, which limits the attack surface to authorized administrators or compromised accounts. If an attacker gains such privileges, the command injection can be used to spawn a reverse shell or install persistence mechanisms, leading to full device takeover. Hence, the risk remains high until the issue is remedied.