5.9
MediumCVSS 3.1 · from VulnCheck
CVE-2026-119560
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
core · CWE-93 · CWE-93Affectedcore
FixNo fix listed yet.
PublishedOct 30, 11:31 · VulnCheck
ScoredOct 30 · 5.9 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can change data. CVSS impact.
Description
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incoreup to 26.7.8–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known