CVE-2026-45158

{
  "id": "CVE-2026-45158",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T22:16:46.363",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8."
    },
    {
      "lang": "es",
      "value": "OPNsense es una plataforma de cortafuegos y enrutamiento basada en FreeBSD. Antes de la 26.1.8, la entrada de usuario no saneada se pasa a la configuración DHCP de la interfaz configurada, que es procesada por un script de shell, permitiendo la ejecución remota de código como root en el sistema operativo subyacente. Esta vulnerabilidad está corregida en la 26.1.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "opnsense",
          "product": "core",
          "versions": [
            {
              "version": "< 26.1.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T12:22:02.967181Z",
          "id": "CVE-2026-45158",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-88"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "26.1.8",
              "matchCriteriaId": "A0EDE7AC-7C9D-4244-9120-DA3CDB7AAB2C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}