EUVD lists OPNsense NTP configuration injection flaw (EUVD-2026-113825)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- OPNsense
- Product
- OPNsense core
- First seen
Summary
The EU Vulnerability Database (EUVD) lists a configuration injection vulnerability in OPNsense core through 26.7.8, scored 6.0/10 under CVSS v3.1. According to the listing, authenticated users can append ntpd.conf directives by embedding newlines in the fudge and refid fields.
If you use OPNsense
Check whether the firewall runs OPNsense core 26.7.8 or earlier
Upgrade OPNsense to a release that the vendor marks as fixed
Limit NTP GPS and PPS page privileges to trusted administrators
Update OPNsense to 26.7.8 or later
Review which accounts hold the System: Firmware privilege and remove unneeded access
Check the configured firmware mirror URL for unexpected values
What the sources say 5
· Mastodon: “OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields.” Source
· Mastodon: “OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations.” Source
· Mastodon: “OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields.” Source
· Mastodon: “OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames.” Source
· Mastodon: “OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL.” Source