Authenticated users with delegated access in the OPNsense Web UI or API can inject carriage return or line feed characters into fields that are expected to contain single lines. The interpreter of these inputs writes the result into privileged service configuration files, thereby allowing attacker‑controlled directives or policy lines to be added. In the Monit case the injection enabled root command execution, while other services such as dnsmasq, OpenVPN, and DHCP did not confirm direct shell access but can still lead to altered service behavior, escalation of privileges or denial of service.

All users of the OPNsense core application prior to version 26.1.11 or 26.4.1p1 are affected. The vulnerable fields appear in configuration pages for dnsmasq (including dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, dhcp_options.value), OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall rules, sudo, WebGUI, and general system settings.

The vulnerability scores a CVSS of 8.1, indicating a high impact. The EPSS score is not available, and the advisory is not catalogued in CISA's KEV list. Exploitation requires the attacker to be authenticated with delegated permissions that allow editing of the affected settings; no public exploit is known. Downstream effects vary but can include unrestricted configuration changes, possible service disruption, and, in at least one instance, execution of arbitrary commands by the root user.