Description
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| opnsense | core | ≤ 26.7.8 | — |
Advisories 1
- WID-SEC-2026-2177 OPNsense: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
References
- https://github.com/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312 technical-description
- https://github.com/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49 technical-description
- GitHub Security Advisory (GHSA-fq94-cxvc-9r7w) related vendor-advisory
- https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge third-party-advisory
- https://github.com/opnsense/core product
- VulnCheck Advisory: OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields third-party-advisory