CVE-2026-58394: fallo de gravedad media en opnsense core
OPNsense: Stored XSS in Administration Settings via Certificate Description
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.2epss 0.2%
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Productos afectados
opnsense · coreCVEs relacionadas — opnsense core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 5.7%CVE-2026-119409HIGHOPNsense before 26.7.8 Root Command Injection via Firmware Mirror SettingEPSS 2.5%CVE-2026-57155CRITICALOPNsense: Root RCE via Arbitrary File Write in GeoIP Alias ImporterEPSS 0.9%CVE-2026-53582HIGHOPNsense: XPATH Injection can disclose any secret in config.xmlEPSS 0.7%CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.7%CVE-2026-58390HIGHOPNsense: Stored XSS to root RCE via OpenVPN client common_name in status viewsEPSS 0.6%