CVE-2026-53581
CriticalCVSS 9.0Summary
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and write user-controlled data to any file.
Risk Assessment
An attacker with access to NTP configuration could overwrite critical system files, potentially leading to full system compromise or permanent damage.
Recommendation
Upgrade opnsense/core to version 26.1.9 or later and BE/opnsense/core to version 26.4_20 or later.
Other vulnerabilities in OPNsense
See all- CVE-2026-45158Critical
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.8, unsanitized user input was passed to the DHCP configuration, allowing remote code execution as root on the underlying operating system.
- CVE-2026-44193Critical
OPNsense is a FreeBSD based firewall and routing platform. In versions prior to 26.1.7, the XMLRPC method opnsense.restore_config_section fails to sanitize user supplied input, leading to Remote Code Execution.
- CVE-2023-39004Critical
Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allow attackers to access sensitive information (e.g., hashed root password) which could lead to privilege escalation.
- CVE-2026-49132Medium
OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the certificate description field. An authenticated attacker can inject arbitrary HTML or JavaScript via the trust certificate API, and the unsanitized description is rendered in the Dashboard Certificates widget, causing script execution in the browser of any authenticated user.
- CVE-2026-49131Medium
OPNsense before version 26.1.9 contains a stored cross-site scripting vulnerability in the firewall rule description field. An authenticated attacker with firewall rule management privileges can inject arbitrary HTML or JavaScript via the filter API endpoint, and the unsanitized description is rendered through the default cell formatter in opnsense_bootgrid.js, causing script execution in the browser of any authenticated user.
- CVE-2023-39003High
OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 were found to have insecure permissions on the /tmp directory. This vulnerability could allow a local attacker to access sensitive data or escalate privileges.
Original NVD description (English source)
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.