CVE-2026-119560
Received Received - Intake

OPNsense Core Configuration Injection via NTPD Directives

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119560
EUVD
EUVD-2026-113825

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in OPNsense core through 26.7.8 allows authenticated users with specific privileges to inject malicious configuration into ntpd.conf by inserting newline characters in the fudge and refid fields. Attackers can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives that ntpd will load and execute as root.

Detection Guidance

Check OPNsense logs for unusual ntpd.conf modifications or entries with newline characters in fudge/refid fields. Inspect services_ntpd_gps.php and services_ntpd_pps.php for CR/LF injection attempts. Monitor ntpd processes running as root for unexpected directive loads.

Impact Analysis

An attacker could exploit this to execute arbitrary commands as root on the OPNsense system, potentially gaining full control over the device. This could lead to network compromise, data exfiltration, or disruption of services relying on ntpd.

Compliance Impact

This vulnerability could lead to unauthorized access or control of network infrastructure, violating confidentiality and integrity requirements in GDPR and HIPAA. Organizations may face compliance violations if exploited, resulting in legal and financial penalties.

Mitigation Strategies

Update OPNsense core to version 26.7.8 or later. Restrict privileges for page-services-ntp-gps and PPS to trusted users only. Review ntpd.conf for unauthorized directives and revert any changes. Disable ntpd if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119560. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart