7 matches found
CVE-2026-119560
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...
CVE-2026-119560
OPNsense core versions through 26.7.8 are vulnerable to a configuration injection flaw due to improper neutralization of CRLF sequences (CWE-93). Authenticated users with page-services-ntp-gps or PPS privileges can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php. This a...
CVE-2026-119560 OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...
EUVD-2026-113825
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...
PT-2026-133498
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services...
opnsense-ntp-gps-fudge
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-ntp-gps-fudge Write-up: https://abraxaslabs.tech/research/opnsense-ntp-gps-fudge opnsense-ntp-gps-fudge Class: Config line injection Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Leftover of...
pfsense-ntp-gps-fudge
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · pfsense-ntp-gps-fudge pfsense-ntp-gps-fudge Class: Config injection Reach: Remote pfSense CE 2.9.0-DEVELOPMENT 9363ac5 - pfsense.org system.inc concatenates GPS/PPS fudge/refid/stratum into ntpd.conf. mwexec is ntpd -...