5.3
MediumCVSS 3.1 · from VulnCheck
CVE-2026-119423
OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
core · CWE-117 · CWE-117Affectedcore
FixUpdate to 26.7.8 or newer
PublishedOct 30, 11:30 · VulnCheck
ScoredOct 30 · 5.3 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incorebefore 26.7.826.7.8
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known