Skip to content
OpenAdvisories
High WID-SEC-2026-1344 2 CVEs

OPNsense: Mehrere Schwachstellen

Published May 3, 2026 · Updated May 14, 2026 · Revision 2 · de-DE

Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in OPNsense ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Code auszuführen.

Product

OPNsense ist eine freie Firewall-Distribution auf Basis von FreeBSD.

Vulnerabilities 2

  • Critical 9.1
    CVE-2026-44193

    OPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` method

    OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7.

    opnsense core
  • Medium 5.3
    CVE-2026-44195

    OPNsense: Authentication lockout bypass

    OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockout_handler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafte…

    opnsense core

Revision history

  1. #2

    CVE ergänzt

  2. #1

    Initiale Fassung

References