{"id":"CVE-2026-57155","published":"2026-10-15T16:18:17.300","lastModified":"2026-10-15T21:08:49.703","description":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-22","CWE-73","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","tags":[]},{"url":"https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","tags":[]},{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","tags":[]},{"url":"https://hackerask.com/posts/opnsense","tags":[]},{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","tags":[]}],"exploitRefs":[{"url":"https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","tags":[]},{"url":"https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","tags":[]},{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","tags":[]},{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","tags":[]}],"hasPoc":true,"ai":{"summary":"A vulnerability in OPNsense's GeoIP importer allows authenticated users with Firewall Alias Edit privileges to craft malicious archive files that can write arbitrary content to system directories with root privileges, potentially leading to complete firewall compromise through command execution via cron jobs.","exploitability":"Moderately difficult to exploit as it requires an authenticated user with Firewall Alias Edit privilege who can configure a custom GeoIP source URL and upload a specially crafted archive file, but the attack path is well-defined and leverages existing system functionality.","blast_radius":"High impact in environments where OPNsense firewalls are managed by multiple users or where administrative privileges are shared, as the vulnerability can lead to complete system compromise with root access.","remediation":"Upgrade to OPNsense 26.1.11 immediately to remediate this critical vulnerability.","detection":"Monitor for unexpected file creation in /usr/local/share/GeoIP/alias directory with -IPv4 or -IPv6 suffixes, and watch for unusual cron job execution patterns in root's crontab that may indicate command injection via newsyslog configuration.","tags":["privilege-escalation","file-write","cron"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:45:13.817Z"}}