CVE-2026-45158 – OPNsense: Command Injection via Attacker-Controlled DHCP Config

CVE ID :CVE-2026-45158

Published : May 13, 2026, 10:16 p.m. | 2 hours, 41 minutes ago

Description :OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8.

Severity: 9.1 | CRITICAL

Visit the link for more details, such as CVSS details, affected products, timeline, and more…