CVE-2026-57155

Summary

A vulnerability in OPNsense's GeoIP importer allows authenticated users with Firewall Alias Edit privileges to craft malicious archive files that can write arbitrary content to system directories with root privileges, potentially leading to complete firewall compromise through command execution via cron jobs.

Exploitability

Moderately difficult to exploit as it requires an authenticated user with Firewall Alias Edit privilege who can configure a custom GeoIP source URL and upload a specially crafted archive file, but the attack path is well-defined and leverages existing system functionality.

Blast radius

High impact in environments where OPNsense firewalls are managed by multiple users or where administrative privileges are shared, as the vulnerability can lead to complete system compromise with root access.

Detection

Monitor for unexpected file creation in /usr/local/share/GeoIP/alias directory with -IPv4 or -IPv6 suffixes, and watch for unusual cron job execution patterns in root's crontab that may indicate command injection via newsyslog configuration.

Prioritized remediation

Upgrade to OPNsense 26.1.11 immediately to remediate this critical vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.