CVE-2026-58392
Received Received - Intake

Stored XSS in OPNsense NTP GPS Configuration Page

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-58392
EUVD
EUVD-2026-102132

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opnsense core < 26.1.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in OPNsense's NTP GPS configuration page. User input in the initcmd field is base64-encoded, then improperly escaped before decoding. When rendered, the decoded input is inserted into a textarea without proper escaping, allowing script execution in the browser of any user viewing the page.

Detection Guidance

Check OPNsense version with 'opnsense-version' command. If version is below 26.1.11 or 26.4.1p1, the system is vulnerable. Inspect the NTP GPS page source for improperly escaped initcmd values in the textarea field.

Impact Analysis

An attacker with page-services-ntp-gps privileges could inject malicious JavaScript to steal session cookies, CSRF tokens, or perform authenticated actions as the victim user. This includes creating new API keys for the root user, potentially leading to full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. The ability to steal credentials or perform privileged actions may result in non-compliance with data protection and security control standards.

Mitigation Strategies

Upgrade OPNsense to version 26.1.11 or later. If immediate upgrade is not possible, restrict access to the NTP GPS page to trusted users only and avoid using privileged accounts for routine tasks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58392. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart