OPNsense 15.7 'Brave Badger'
OPNsense 15.7 'Brave Badger'
The OPNsense 15.7 'Brave Badger' reached end of service life on Jan 28, 2016 — OPNsense no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your OPNsense 15.7 'Brave Badger' incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- opnsense
- release
- 15.7
- product Label
- OPNsense
- release Label
- 15.7 'Brave Badger'
- codename
- Brave Badger
- lts
- latest Version
- 15.7.25
- release Date
- 2015-07-02
- maintained
- source Url
- https://endoflife.date/opnsense
Lifecycle Dates
- End of Service Life
- Jan 28, 2016
- Last OEM Support
- Jan 28, 2016
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for OPNsense 15.7 'Brave Badger' — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for OPNsense 15.7 'Brave Badger'?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for OPNsense 15.7 'Brave Badger' when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
OPNsense 15.7 'Brave Badger' Support: Frequently Asked Questions
Is the OPNsense 15.7 'Brave Badger' still supported?
OPNsense ended support for the OPNsense 15.7 'Brave Badger' on Jan 28, 2016 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the OPNsense 15.7 'Brave Badger' end of service life (EOSL) date?
OPNsense lists the end of service life for the OPNsense 15.7 'Brave Badger' as Jan 28, 2016.
Can I keep using the OPNsense 15.7 'Brave Badger' after its EOSL date?
Yes. EOSL means OPNsense stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the OPNsense 15.7 'Brave Badger' cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting OPNsense 15.7 'Brave Badger'
24 published CVEs affect the OPNsense 15.7 'Brave Badger', including 13 rated critical or high severity. OPNsense no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2023-39008 | CRITICAL | 9.8 | Aug 9, 2023 | A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands. |
| CVE-2023-39004 | CRITICAL | 9.8 | Aug 9, 2023 | Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation. |
| CVE-2023-39001 | CRITICAL | 9.8 | Aug 9, 2023 | A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary commands via a crafted backup configuration file. |
| CVE-2023-39007 | CRITICAL | 9.6 | Aug 9, 2023 | /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app/controllers/OPNsense/Cron/ItemController.php. |
| CVE-2026-45158 | CRITICAL | 9.1 | May 13, 2026 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, unsanitized user input is passed to the DHCP configuration of the configured interface, which is processed by a shell script, allowing remote code execution as root on the underlying operating system. This vulnerability is fixed in 26.1.8. |
| CVE-2026-44194 | CRITICAL | 9.1 | May 13, 2026 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsen |
| CVE-2026-44193 | CRITICAL | 9.1 | May 13, 2026 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input leading to Remote Code Execution. This vulnerability is fixed in 26.1.7. |
| CVE-2025-50989 | CRITICAL | 9.1 | Aug 27, 2025 | OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edit.php). The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitrary shell operators and payloads. Successful exploitation results in remote code execution with the privileges of the web service (typically root), potentially leading to full system compromise or lat |
| CVE-2026-34578 | HIGH | 8.2 | Apr 9, 2026 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filter metacharacters into the username field of the WebGUI login page to enumerate valid LDAP usernames in the configured directory. When the LDAP server configuration includes an Extended Query to restrict login to members of a specific group, |
| CVE-2023-39005 | HIGH | 7.5 | Aug 9, 2023 | Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. |
| CVE-2023-39003 | HIGH | 7.5 | Aug 9, 2023 | OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp. |
| CVE-2023-38997 | HIGH | 7.2 | Aug 9, 2023 | A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary system commands as root via a crafted ZIP archive. |
| CVE-2019-11816 | HIGH | 7.2 | May 20, 2019 | Incorrect access control in the WebUI in OPNsense before version 19.1.8, and pfsense before 2.4.4-p3 allows remote authenticated users to escalate privileges to administrator via a specially crafted request. |
| CVE-2023-38999 | MEDIUM | 6.5 | Aug 9, 2023 | A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to cause a Denial of Service (DoS) via a crafted GET request. |
| CVE-2026-30868 | MEDIUM | 6.3 | Mar 11, 2026 | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE methods, allowing authenticated GET requests to bypass CSRF verification. As a result, a malicious website can trigger privileged backend actions when visited by an authenticated user, causing unintended s |
| CVE-2023-39002 | MEDIUM | 6.1 | Aug 9, 2023 | A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
| CVE-2023-39000 | MEDIUM | 6.1 | Aug 9, 2023 | A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path. |
| CVE-2023-38998 | MEDIUM | 6.1 | Aug 9, 2023 | An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL. |
| CVE-2021-42770 | MEDIUM | 6.1 | Nov 8, 2021 | A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester. |
| CVE-2020-23015 | MEDIUM | 6.1 | May 3, 2021 | An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website. |
Showing the 20 most severe of 24 known CVEs.
Get Third Party Support