CVE-2026-58392 in OPNsense
Summary
by MITRE • 10/15/2026
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in OPNsense versions prior to 26.1.11 represents a critical stored cross-site scripting flaw rooted in improper input validation and output encoding sequencing within the Network Time Protocol GPS configuration interface. The system operates on a FreeBSD-based architecture, serving as both a firewall and routing platform for enterprise networks. In this specific component, located at src/www/services_ntpd_gps.php, the application accepts an operator-supplied initialization command intended to configure NTP GPS hardware. Instead of validating or sanitizing the input directly, the software first encodes the user-provided string into base64 format. It then applies a legacy HTML escaping function specifically designed for form data to this encoded representation. The critical technical failure occurs during the rendering phase, where the application decodes the escaped base64 string back into its original plaintext form before injecting it directly into the value attribute of an HTML textarea element without performing any subsequent output encoding on the decoded result. This sequence error means that while special characters were technically processed by the escaping function, they were reconstituted as raw executable content upon decoding, effectively bypassing the security controls intended to prevent script injection.
From a technical perspective, this flaw allows an attacker with page-services-ntp-gps privileges to inject malicious JavaScript payloads into the application's persistent storage layer. By crafting input that includes HTML tags and event handlers, such as closing the textarea tag and appending a script element or inline event handler like onerror, the stored payload becomes part of the page structure itself. When any subsequent user accesses the GPS configuration page, including administrators with elevated privileges, their browser executes the injected scripts within the context of the OPNsense web interface session. This execution environment grants the malicious script full access to the document object model and associated cookies or tokens used for authentication and request signing. Consequently, an attacker can exfiltrate sensitive information such as CSRF protection tokens, session identifiers, and other confidential data displayed on the page.
The operational impact of this vulnerability is severe due to its potential for privilege escalation through automated attack chains. Because the script executes in the context of any user who views the page, a lower-privileged operator can leverage their access to perform actions that are normally restricted to administrators. This includes modifying firewall rules, changing routing configurations, or disabling security features by submitting authenticated requests with valid CSRF tokens harvested from the victim's session. The ability to automate these interactions means that an attacker does not need to trick a user into clicking a link; simply having administrative staff visit the compromised GPS page is sufficient to trigger the attack vector. This undermines the fundamental principle of least privilege and compromises the integrity of the network infrastructure managed by OPNsense, potentially leading to unauthorized access, data leakage, or complete system compromise depending on the specific actions performed via the injected scripts.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause for cross-site scripting attacks. The root cause is specifically related to incorrect encoding order, where decoding occurs after escaping rather than before or in isolation from output contexts. In terms of offensive security frameworks, this behavior maps directly to the MITRE ATT&CK technique T1059.007, which covers JavaScript execution within web browsers as a method for initial access and lateral movement. The stored nature of the payload also corresponds to persistence mechanisms where malicious code is embedded in legitimate application data to ensure repeated execution upon victim interaction.
To mitigate this vulnerability, organizations running OPNsense must upgrade immediately to version 26.1.11 or later, which corrects the encoding logic by ensuring that output escaping is applied after decoding or by validating input against a strict allowlist of expected characters for GPS initialization commands. Until an upgrade can be performed in controlled environments, administrators should restrict access to the NTP GPS configuration page exclusively to trusted personnel and monitor logs for unusual activity related to this interface. Additionally, implementing Content Security Policy headers within the web server configuration can help mitigate the impact by restricting script execution sources, although upgrading remains the only definitive remediation strategy given the fundamental flaw in input handling logic.