CVE-2026-58392

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

CVE-2026-58392 OPNsense: Stored XSS in Services: NTP GPS

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

CVE-2026-58392

The OPNsense firewall and routing platform (prior to version 26.1.11 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in the NTP GPS page. The root cause is that the src/www/services_ntpd_gps.php component applies legacy_html_escape_form_data() to a base64-encoded initcmd value but sub...

EUVD-2026-102132

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacyhtmlescapeformdata to the encoded string, and then uses base64decode to decode the value directly into the GPS...

Improper access control

Improper access control vulnerability in pfSense CE and pfSense Plus pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01 allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result ...

CVE-2022-26019: Improper Limitation of a Pathname to a Restricted Directory

Improper access control vulnerability in pfSense CE and pfSense Plus pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01 allows a remote attacker with the privilege to change NTP GPS settings to rewrite existing files on the file system, which may result ...

PT-2022-17635 · Unknown · Pfsense Ce +1

Name of the Vulnerable Software and Affected Versions: pfSense CE versions prior to 2.6.0 pfSense Plus versions prior to 22.01 Description: The issue is related to improper access control in pfSense CE and pfSense Plus, allowing a remote attacker with the privilege to change NTP GPS settings to...

Multiple vulnerabilities in pfSense

Overview pfSense software provided by Netgate contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2021-20729 Improper access control CWE-284 - CVE-2022-26019 Improper input validation CWE-20 - CVE-2022-24299 Yutaka WATANABE of Ierae Security Inc. reported these...

PT-2012-3176

Name of the Vulnerable Software and Affected Versions UTC Fire & Security GE-MC100-NTP/GPS-ZB Master Clock device affected versions not specified Description The issue concerns the use of hardcoded credentials for an administrative account in the device, making it easier for remote attackers to...

CVE-2012-1288: Undefined Security Weakness

The UTC Fire & Security GE-MC100-NTP/GPS-ZB Master Clock device uses hardcoded credentials for an administrative account, which makes it easier for remote attackers to obtain access via an HTTP session...