{"schemaVersion":2,"id":"CVE-2026-57155","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11.","dates":{"published":"2026-10-15T15:13:12.343Z","modified":"2026-10-15T15:45:48.529Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.9,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.9,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html","capec":[{"id":"CAPEC-126","name":"Path Traversal","url":"https://capec.mitre.org/data/definitions/126.html"},{"id":"CAPEC-64","name":"Using Slashes and URL Encoding Combined to Bypass Validation Logic","url":"https://capec.mitre.org/data/definitions/64.html"},{"id":"CAPEC-76","name":"Manipulating Web Input to File System Calls","url":"https://capec.mitre.org/data/definitions/76.html"},{"id":"CAPEC-78","name":"Using Escaped Slashes in Alternate Encoding","url":"https://capec.mitre.org/data/definitions/78.html"},{"id":"CAPEC-79","name":"Using Slashes in Alternate Encoding","url":"https://capec.mitre.org/data/definitions/79.html"}],"techniques":[],"countermeasures":[]},{"id":"CWE-73","name":"External Control of File Name or Path","description":"The product allows user input to control or influence paths or file names that are used in filesystem operations.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/73.html","capec":[{"id":"CAPEC-13","name":"Subverting Environment Variable Values","url":"https://capec.mitre.org/data/definitions/13.html"},{"id":"CAPEC-267","name":"Leverage Alternate Encoding","url":"https://capec.mitre.org/data/definitions/267.html"},{"id":"CAPEC-64","name":"Using Slashes and URL Encoding Combined to Bypass Validation Logic","url":"https://capec.mitre.org/data/definitions/64.html"},{"id":"CAPEC-72","name":"URL Encoding","url":"https://capec.mitre.org/data/definitions/72.html"},{"id":"CAPEC-76","name":"Manipulating Web Input to File System Calls","url":"https://capec.mitre.org/data/definitions/76.html"},{"id":"CAPEC-78","name":"Using Escaped Slashes in Alternate Encoding","url":"https://capec.mitre.org/data/definitions/78.html"},{"id":"CAPEC-79","name":"Using Slashes in Alternate Encoding","url":"https://capec.mitre.org/data/definitions/79.html"},{"id":"CAPEC-80","name":"Using UTF-8 Encoding to Bypass Validation Logic","url":"https://capec.mitre.org/data/definitions/80.html"}],"techniques":[{"id":"T1027","name":"Obfuscated Files or Information","url":"https://attack.mitre.org/techniques/T1027/","tactics":[{"id":"TA0005","name":"Stealth"}]},{"id":"T1562.003","name":"Impair Command History Logging","url":"https://attack.mitre.org/techniques/T1562/003/","tactics":[{"id":"TA0005","name":"Stealth"}]},{"id":"T1574.006","name":"Dynamic Linker Hijacking","url":"https://attack.mitre.org/techniques/T1574/006/","tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}]},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","url":"https://attack.mitre.org/techniques/T1574/007/","tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}]}],"countermeasures":[{"id":"D3-ACH","name":"Application Configuration Hardening","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-ACH/"},{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-DRA","name":"Disable Remote Access","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-DRA/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-RKD","name":"Registry Key Deletion","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-RKD/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"}]},{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","description":"The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/78.html","capec":[{"id":"CAPEC-108","name":"Command Line Execution through SQL Injection","url":"https://capec.mitre.org/data/definitions/108.html"},{"id":"CAPEC-15","name":"Command Delimiters","url":"https://capec.mitre.org/data/definitions/15.html"},{"id":"CAPEC-43","name":"Exploiting Multiple Input Interpretation Layers","url":"https://capec.mitre.org/data/definitions/43.html"},{"id":"CAPEC-6","name":"Argument Injection","url":"https://capec.mitre.org/data/definitions/6.html"},{"id":"CAPEC-88","name":"OS Command Injection","url":"https://capec.mitre.org/data/definitions/88.html"}],"techniques":[],"countermeasures":[]}],"ttp":{"capecs":[{"id":"CAPEC-108","name":"Command Line Execution through SQL Injection","url":"https://capec.mitre.org/data/definitions/108.html","weaknessIds":["CWE-78"],"techniqueIds":[]},{"id":"CAPEC-126","name":"Path Traversal","url":"https://capec.mitre.org/data/definitions/126.html","weaknessIds":["CWE-22"],"techniqueIds":[]},{"id":"CAPEC-13","name":"Subverting Environment Variable Values","url":"https://capec.mitre.org/data/definitions/13.html","weaknessIds":["CWE-73"],"techniqueIds":["T1562.003","T1574.006","T1574.007"]},{"id":"CAPEC-15","name":"Command Delimiters","url":"https://capec.mitre.org/data/definitions/15.html","weaknessIds":["CWE-78"],"techniqueIds":[]},{"id":"CAPEC-267","name":"Leverage Alternate Encoding","url":"https://capec.mitre.org/data/definitions/267.html","weaknessIds":["CWE-73"],"techniqueIds":["T1027"]},{"id":"CAPEC-43","name":"Exploiting Multiple Input Interpretation Layers","url":"https://capec.mitre.org/data/definitions/43.html","weaknessIds":["CWE-78"],"techniqueIds":[]},{"id":"CAPEC-6","name":"Argument Injection","url":"https://capec.mitre.org/data/definitions/6.html","weaknessIds":["CWE-78"],"techniqueIds":[]},{"id":"CAPEC-64","name":"Using Slashes and URL Encoding Combined to Bypass Validation Logic","url":"https://capec.mitre.org/data/definitions/64.html","weaknessIds":["CWE-22","CWE-73"],"techniqueIds":[]},{"id":"CAPEC-72","name":"URL Encoding","url":"https://capec.mitre.org/data/definitions/72.html","weaknessIds":["CWE-73"],"techniqueIds":[]},{"id":"CAPEC-76","name":"Manipulating Web Input to File System Calls","url":"https://capec.mitre.org/data/definitions/76.html","weaknessIds":["CWE-22","CWE-73"],"techniqueIds":[]},{"id":"CAPEC-78","name":"Using Escaped Slashes in Alternate Encoding","url":"https://capec.mitre.org/data/definitions/78.html","weaknessIds":["CWE-22","CWE-73"],"techniqueIds":[]},{"id":"CAPEC-79","name":"Using Slashes in Alternate Encoding","url":"https://capec.mitre.org/data/definitions/79.html","weaknessIds":["CWE-22","CWE-73"],"techniqueIds":[]},{"id":"CAPEC-80","name":"Using UTF-8 Encoding to Bypass Validation Logic","url":"https://capec.mitre.org/data/definitions/80.html","weaknessIds":["CWE-73"],"techniqueIds":[]},{"id":"CAPEC-88","name":"OS Command Injection","url":"https://capec.mitre.org/data/definitions/88.html","weaknessIds":["CWE-78"],"techniqueIds":[]}],"techniques":[{"id":"T1027","name":"Obfuscated Files or Information","url":"https://attack.mitre.org/techniques/T1027/","weaknessIds":["CWE-73"],"capecIds":["CAPEC-267"],"tactics":[{"id":"TA0005","name":"Stealth"}],"countermeasures":[{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"}]},{"id":"T1562.003","name":"Impair Command History Logging","url":"https://attack.mitre.org/techniques/T1562/003/","weaknessIds":["CWE-73"],"capecIds":["CAPEC-13"],"tactics":[{"id":"TA0005","name":"Stealth"}],"countermeasures":[{"id":"D3-ACH","name":"Application Configuration Hardening","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-ACH/"},{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-DRA","name":"Disable Remote Access","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-DRA/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-RKD","name":"Registry Key Deletion","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-RKD/"}]},{"id":"T1574.006","name":"Dynamic Linker Hijacking","url":"https://attack.mitre.org/techniques/T1574/006/","weaknessIds":["CWE-73"],"capecIds":["CAPEC-13"],"tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}],"countermeasures":[{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"}]},{"id":"T1574.007","name":"Path Interception by PATH Environment Variable","url":"https://attack.mitre.org/techniques/T1574/007/","weaknessIds":["CWE-73"],"capecIds":["CAPEC-13"],"tactics":[{"id":"TA0005","name":"Stealth"},{"id":"TA0104","name":"Execution"}],"countermeasures":[{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"}]}],"countermeasures":[{"id":"D3-ACH","name":"Application Configuration Hardening","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-ACH/"},{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"},{"id":"D3-DRA","name":"Disable Remote Access","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-DRA/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"},{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"},{"id":"D3-RKD","name":"Registry Key Deletion","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-RKD/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"}],"countermeasuresByTactic":[{"tactic":"Harden","items":[{"id":"D3-ACH","name":"Application Configuration Hardening","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-ACH/"},{"id":"D3-DRA","name":"Disable Remote Access","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-DRA/"},{"id":"D3-FE","name":"File Encryption","tactic":"Harden","url":"https://d3fend.mitre.org/technique/d3f:D3-FE/"}]},{"tactic":"Detect","items":[{"id":"D3-DA","name":"Dynamic Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-DA/"},{"id":"D3-EFA","name":"Emulated File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-EFA/"},{"id":"D3-FA","name":"File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FA/"},{"id":"D3-FIM","name":"File Integrity Monitoring","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-FIM/"},{"id":"D3-SFA","name":"System File Analysis","tactic":"Detect","url":"https://d3fend.mitre.org/technique/d3f:D3-SFA/"}]},{"tactic":"Isolate","items":[{"id":"D3-CF","name":"Content Filtering","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CF/"},{"id":"D3-CM","name":"Content Modification","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CM/"},{"id":"D3-CQ","name":"Content Quarantine","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-CQ/"},{"id":"D3-EAL","name":"Executable Allowlisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EAL/"},{"id":"D3-EDL","name":"Executable Denylisting","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-EDL/"},{"id":"D3-LFP","name":"Local File Permissions","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-LFP/"},{"id":"D3-RFAM","name":"Remote File Access Mediation","tactic":"Isolate","url":"https://d3fend.mitre.org/technique/d3f:D3-RFAM/"}]},{"tactic":"Evict","items":[{"id":"D3-FEV","name":"File Eviction","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-FEV/"},{"id":"D3-RKD","name":"Registry Key Deletion","tactic":"Evict","url":"https://d3fend.mitre.org/technique/d3f:D3-RKD/"}]},{"tactic":"Restore","items":[{"id":"D3-RC","name":"Restore Configuration","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RC/"},{"id":"D3-RF","name":"Restore File","tactic":"Restore","url":"https://d3fend.mitre.org/technique/d3f:D3-RF/"}]},{"tactic":"Deceive","items":[{"id":"D3-DF","name":"Decoy File","tactic":"Deceive","url":"https://d3fend.mitre.org/technique/d3f:D3-DF/"}]},{"tactic":"Model","items":[{"id":"D3-CI","name":"Configuration Inventory","tactic":"Model","url":"https://d3fend.mitre.org/technique/d3f:D3-CI/"}]}]},"affected":[{"vendor":"opnsense","product":"core","name":"core","label":"core","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 26.1.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 26.1.11","eol":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","label":"github.com/opnsense/core/security/advisories/GHSA-wjqq-rfmm-v5h3","hostname":"github.com","tags":["X Refsource CONFIRM"]},{"url":"https://github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","label":"github.com/opnsense/core/commit/c46aced9c47d956167e294911113bc334fea5f48","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","label":"github.com/opnsense/core/commit/e7fbfaa7f5e070da667e3f243da11fd3d4b731fa","hostname":"github.com","tags":["X Refsource MISC"]},{"url":"https://hackerask.com/posts/opnsense","label":"hackerask.com/posts/opnsense","hostname":"hackerask.com","tags":["X Refsource MISC"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-15T15:13:12.343Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-15T15:45:48.529Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-15T22:53:23.150Z","stale":false,"partial":false}}