CVE-2026-57155

9.9Critical

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.9Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-22, CWE-73, CWE-78

Impact

Authenticated users with Firewall Alias Edit privileges can execute arbitrary commands as root via a cron job, taking full control of the firewall. They need an active account with alias editing rights and the ability to configure a custom GeoIP source URL.

Root cause

The GeoIP importer fails to sanitize the CSV country_code field, allowing path traversal that writes attacker-controlled files as root with an IPv4 or IPv6 suffix.

Affected systems

OPNsense versions prior to 26.1.11

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade OPNsense to version 26.1.11 or later. If patching immediately is not possible, revoke Firewall Alias Edit permissions from non-admin accounts and block outbound downloads to untrusted GeoIP URLs.

shell

$ opnsense-update

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-57155