CVE-2026-57154 | OPNsense up to 26.1.10/26.4.1p0 Dnsmasq dnsmasq.conf filename/servername/address/value/mail password os command injection

A vulnerability was found in OPNsense up to 26.1.10/26.4.1p0. It has been classified as problematic. Affected by this issue is some unknown functionality of the file /usr/local/etc/dnsmasq.conf of the component Dnsmasq/Monit/OpenVPN/DHCPv6/Unbound/IPsec/NTP/PPP/MPD/WebGUI. This manipulation of the argument filename/servername/address/value/mail password causes os command injection.

The identification of this vulnerability is CVE-2026-57154. It is possible to initiate the attack remotely. There is no exploit available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More