Skip to content
OpenAdvisories
High WID-SEC-2026-2177 12 CVEs

OPNsense: Mehrere Schwachstellen

Published Jul 1, 2026 · Updated Nov 3, 2026 · Revision 5 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in OPNsense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um Dateien zu manipulieren, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.

Product

OPNsense ist eine freie Firewall-Distribution auf Basis von FreeBSD.

Vulnerabilities 12

  • Critical 9.9
    CVE-2026-57155 Public exploit

    OPNsense: Root RCE via Arbitrary File Write in GeoIP Alias Importer

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to cons…

    opnsense core
  • High 8.1
    CVE-2026-57154

    OPNsense: Configuration line injection via multiple GUI text fields

    OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated pri…

    opnsense core
  • High 8.1
    CVE-2026-63442

    OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-…

    opnsense core
  • High 8.0
    CVE-2026-58390

    OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-nam…

    opnsense core
  • High 7.1
    CVE-2026-71490

    OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

    OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user …

    opnsense core
  • Medium 5.9
    CVE-2026-119560

    OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

    OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can …

    opnsense core
  • Medium 5.9
    CVE-2026-58393

    OPNsense: OpenVPN Client Specific Override common_name allows path traversal in generated CSO files

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/…

    opnsense core
  • Medium 5.4
    CVE-2026-58391

    OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filter_rule.volt and nat_rule.volt without quote-safe encoding. …

    opnsense core
  • Medium 5.4
    CVE-2026-58392

    OPNsense: Stored XSS in Services: NTP GPS

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to dec…

    opnsense core
  • Medium 5.3
    CVE-2026-119423

    OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

    OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victi…

    opnsense core
  • Medium 5.2
    CVE-2026-58394

    OPNsense: Stored XSS in Administration Settings via Certificate Description

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr valu…

    opnsense core
  • Medium 4.3
    CVE-2026-58395

    OPNsense: XPath injection in MVC safe-delete

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over…

    opnsense core

Revision history

  1. #5

    Referenz(en) aufgenommen: EUVD-2026-116116

  2. #4

    Referenz(en) aufgenommen: CVE-2026-119560, EUVD-2026-113825

  3. #3

    Referenz(en) aufgenommen: CVE-2026-119423, EUVD-2026-113803

  4. #2

    Referenzen eingetragen

  5. #1

    Initiale Fassung

References