opnsense-lockout-factory-ip

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-lockout-factory-ip Write-up: https://abraxaslabs.tech/research/opnsense-lockout-factory-ip opnsense-lockout-factory-ip Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Unau...

CVE-2026-119423

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockouthandler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the...

EUVD-2026-113803

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockouthandler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the...

CVE-2026-119423 OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockouthandler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the...

CVE-2026-119423 OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockouthandler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the...

CVE-2026-119423

OPNsense core versions prior to 26.7.8 are vulnerable to a log injection vulnerability (CWE-117). This flaw allows unauthenticated attackers to plant arbitrary victim IP addresses into the lockout_handler by submitting crafted usernames during WebGUI login attempts. By repeatedly submitting usern...

CVE-2026-119423: opnsense core: OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant…

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockouthandler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the...

CVE-2026-63442

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters that survive LOGAUTH processing through syslog-ng-lockout.conf into the syslog-ng program destination feeding...

CVE-2026-44195

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockouthandler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword...

CVE-2026-44195: Improper Restriction of Excessive Authentication Attempts

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.7, a logic flaw in the OPNsense lockouthandler allows an unauthenticated attacker to continuously reset the authentication failure counter for their IP address. By interjecting a crafted username containing a success keyword...