opnsense

7 results · Clear filters · Feed

• High 8.1
  CVE-2026-57154

  OPNsense: Configuration line injection via multiple GUI text fields

  OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated pri…

  opnsense core
  Nov 3, 2026
• High 7.2
  CVE-2026-119409

  OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting

  OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell metacharacters through POS…

  opnsense core
  Oct 30, 2026
• High 7.1
  CVE-2026-71490

  OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

  OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one string and then uses an exact comparison when checking user-config-readonly. A user …

  opnsense core
  Oct 15, 2026
• High 8.1
  CVE-2026-63442

  OPNsense: Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking

  OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOG_AUTH processing through syslog-ng-lockout.conf into the syslog-…

  opnsense core
  Oct 15, 2026
• High 8.0
  CVE-2026-58390

  OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views

  OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client common_name into data-common-nam…

  opnsense core
  Oct 15, 2026
• High 7.1
  CVE-2026-53582 Public exploit

  OPNsense: XPATH Injection can disclose any secret in config.xml

  OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPN…

  opnsense core
  Oct 15, 2026
• High 8.2
  CVE-2026-34578

  OPNsense has an LDAP Injection via Unsanitized Username in Authentication

  OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.6, OPNsense's LDAP authentication connector passes the login username directly into an LDAP search filter without calling ldap_escape(). An unauthenticated attacker can inject LDAP filte…

  opnsense core
  Apr 9, 2026