Horizon Alert
Summary of the vulnerability and why it matters
This OPNsense vulnerability allows remote code execution as root. Unsanitized user input in the DHCP configuration is processed by a shell script, creating a significant risk for affected systems.
- Affects firewall and routing platforms.
- Potential for complete system compromise.
Attack Path
How an attacker could exploit the issue
An attacker with administrative access to OPNsense could exploit this by injecting malicious commands into the DHCP configuration. This would allow them to execute arbitrary code as root on the underlying FreeBSD operating system, potentially compromising the entire network infrastructure managed by the firewall.
- Requires administrative credentials.
- Targets DHCP configuration interface.
- Unsanitized input leads to shell script execution.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in OPNsense allows for remote code execution as root, a severe impact. While the affected system is a firewall, which is typically exposed to the internet, this specific vulnerability requires authenticated access to the administrative interface. This significantly limits the attack surface to individuals who already have credentials or can compromise them through other means.
- Exploitation requires administrator credentials.
- No public exploits are currently observed.
- The fix is recent.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching OPNsense instances to 26.1.8 or later to remediate critical remote code execution. If immediate patching is not feasible, isolate affected devices or restrict administrative access to trusted networks to prevent exploitation.
- Patch to version 26.1.8.
- Isolate affected devices.
- Monitor for suspicious administrative access.
