CVE-2026-119560 in core
Summary
by MITRE • 10/30/2026
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in OPNsense core versions through 26.7.8 represents a critical configuration injection flaw within the Network Time Protocol daemon management interface. This security issue specifically affects authenticated users who possess either the page-services-ntp-gps or PPS privileges, which are typically granted to administrators responsible for managing hardware timestamping and global positioning system synchronization services. The core of the vulnerability lies in insufficient input validation when processing data submitted through the web-based configuration pages services_ntpd_gps.php and services_ntpd_pps.php. These interfaces allow users to define parameters such as fudge and refid, which are intended to configure specific operational behaviors for NTP daemons interacting with external time sources or hardware clocks.
The technical mechanism of exploitation involves embedding carriage return and line feed characters into these input fields. By injecting newline sequences, an attacker can break out of the expected single-line configuration format and append arbitrary directives directly into the ntpd.conf file. This technique effectively bypasses any intended structural constraints on the configuration data. Because the NTP daemon runs with root privileges to access hardware interfaces and adjust system time accurately, any configuration directive injected via this method is executed with elevated permissions. This allows an attacker who has gained authenticated access through these specific privilege sets to execute arbitrary commands or modify critical system behaviors under the context of the root user.
The operational impact of this vulnerability is severe due to the potential for full system compromise. An adversary can leverage this configuration injection to achieve remote code execution with root-level privileges, effectively taking control of the OPNsense firewall appliance. Beyond simple command execution, the attacker could modify network routing rules, disable security logging, or install persistent backdoors that survive reboots and standard security scans. The ability to manipulate ntpd.conf also poses a risk to time synchronization integrity, which is foundational for many other security mechanisms such as certificate validation, log correlation, and Kerberos authentication across the broader network infrastructure protected by the firewall.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code Command Injection, specifically where user input is directly incorporated into a command or configuration file without adequate sanitization. From an offensive security perspective, it maps to ATT&CK technique T1505.003 Server Software Component: Web Shell, as the attacker can potentially deploy persistent access mechanisms through modified service configurations. It also relates to T1496 Resource Hijacking if used for denial of service or T1078 Valid Accounts if the initial foothold relies on compromised credentials with limited privileges that are then escalated via this configuration flaw.
Mitigation strategies must prioritize immediate patching to a version of OPNsense core later than 26.7.8, where input validation and output encoding have been strengthened to prevent newline injection in these specific fields. In the interim, administrators should enforce strict least-privilege principles by restricting access to page-services-ntp-gps and PPS privileges only to essential personnel who require them for hardware timestamping operations. Additionally, implementing network segmentation to limit administrative interface accessibility from untrusted networks can reduce the attack surface. Regular auditing of configuration files and monitoring for unexpected changes in ntpd.conf or related service states is recommended to detect any potential exploitation attempts early.