An authenticated user with privileges to manage other users in OPNsense can inject arbitrary system commands through the user management interface. By submitting a payload that masquerades as a valid email address, the attacker bypasses input validation, causing the underlying operating system to execute shell commands. This flaw is an instance of OS Command Injection (CWE‑78) and poses a complete compromise of the device, allowing full root‑level control.

The vulnerability affects the OPNsense firewall and routing platform, specifically the core component before version 26.1.8. Users running any pre‑26.1.8 build of OPNsense are potentially exposed. The flaw resides in the local user synchronization script located in the path core/src/opnsense/scripts/auth/sync_user.php.

With a CVSS score of 9.1 the vulnerability is rated as critical, reflecting a high impact if exploited. The EPSS score is <1%, and the absence of a listing in CISA KEV does not reduce the inherent risk. Exploitation requires authentication and user‑management rights, limiting the attack surface to authorized administrators or compromised accounts. An attacker who gains such privileges can execute arbitrary system commands as root, effectively compromising the device. The risk remains high until the issue is addressed.