CVE-2026-119560

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...

EUVD-2026-113825

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...

CVE-2026-119560

OPNsense core versions through 26.7.8 are vulnerable to a configuration injection flaw due to improper neutralization of CRLF sequences (CWE-93). Authenticated users with page-services-ntp-gps or PPS privileges can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php. This a...

CVE-2026-119560 OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields

OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via...