OPNsense is a FreeBSD based firewall and routing platform
Why It Matters
Analysis dossierWhy It Matters
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.
High Severity / Review
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; CRITICAL severity; Critical CVSS without confirmed KEV exploitation
Affected Products & Remediation
0 source-backed productsVendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched command-injection (CWE-78); path-traversal (CWE-22)
Exposure
- Identify installations of the affected product and compare versions with the advisory.Telemetry: DeviceTvmSoftwareVulnerabilities · A weakness class does not establish local exposure. · Rule command-injection
- Locate affected deployments and the path-handling endpoint named by the advisory.Telemetry: Application access logs · The affected path must come from the source, not the CWE alone. · Rule path-traversal
Exploitation evidence
- Review command interpreters spawned by the affected service or application.Telemetry: DeviceProcessEvents · Unexpected process lineage can support command-injection hunting. · Rule command-injection
Show more (2)
Exploitation evidence
- Review requests to that endpoint for traversal encodings and unusual file responses.Telemetry: Application access logs · Such patterns are a hypothesis to validate against normal traffic. · Rule path-traversal
Response
- Confirm the vendor mitigation or fixed version on affected assets.Telemetry: DeviceTvmSoftwareVulnerabilities · Inventory checks can verify remediation. · Rule command-injection
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- security-advisories@github.com
- Record status · verification
- UPDATED · NVD API
- CPE
- Unknown
Evidence & Provenance
— No published hunting query names this record. Browse community and library queries instead.
Correlated briefings
— No published briefing references this CVE