Prior to release 26.1.8, user input directed at the DHCP configuration of an interface in OPNsense is forwarded without sanitization to a shell script that processes the configuration. This unsanitized data can be crafted by an attacker to execute arbitrary shell commands with root privileges on the underlying FreeBSD operating system, giving full control over the device. The vulnerability is classified as CWE-88, indicating a command injection flaw. The impact thus spans all confidentiality, integrity, and availability aspects of the impacted system.

The affected product is OPNsense core. All instances running a version earlier than 26.1.8 are potentially vulnerable. No additional vendor or product list is available beyond the core package.

The CVSS score of 9.1 places this flaw in the high- to critical‑risk category. Although the EPSS value is not reported, the lack of a KEV listing suggests no confirmed public exploits are available yet. The attack vector is likely remote, requiring the attacker to have network access that permits sending specially crafted DHCP configuration commands to the OPNsense box. Based on the description, it is inferred that the attacker could trigger the vulnerability by manipulating DHCP traffic directed at the device’s interface. Should the system expose the DHCP configuration interface to external networks or lack proper authentication, exploitation feasibility rises significantly. Administrators should treat this as a high‑risk vulnerability requiring prompt remediation.