CVE-2026-119560 json
OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
published 2026-10-30 10 d ago modified 2026-10-30 9 d ago also EUVD-2026-113825
- cvss
- 5.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps or PPS privilege can submit CR/LF characters via services_ntpd_gps.php or services_ntpd_pps.php to inject directives loaded by ntpd running as root.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 d ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L |
| CNA | 4.0 | 6.0 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- opnsense core
Classification
- Weakness
-
- CWE-93 Improper Neutralization of CRLF Sequences
References
-
github.com
/opnsense/core/security/advisories/GHSA-fq94-cxvc-9r7w
related, vendor-advisory
-
github.com
/opnsense/core/blob/26.7.8/src/etc/inc/plugins.inc.d/ntpd.inc#L285-L312
technical-description
-
github.com
/opnsense/core/blob/26.7.8/src/www/services_ntpd_gps.php#L49
technical-description
-
abraxaslabs.tech
/research/opnsense-ntp-gps-fudge
third-party-advisory
-
github.com
/opnsense/core
product
-
vulncheck.com
/advisories/opnsense-core-through-26.7.8-ntp-configuration-injection-via-gps-and-pps-fudge-fields
third-party-advisory
Sources
- CVE List CVE-2026-119560
- NVD CVE-2026-119560
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.