CVE-2026-119424mediumCWE-93

CVE-2026-119424: falha de média gravidade em opnsense core

OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.1epss 0.4%
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
opnsense · core
CVEs relacionadas — opnsense core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 5.7%CVE-2026-119409HIGHOPNsense before 26.7.8 Root Command Injection via Firmware Mirror SettingEPSS 2.5%CVE-2026-57155CRITICALOPNsense: Root RCE via Arbitrary File Write in GeoIP Alias ImporterEPSS 0.9%CVE-2026-53582HIGHOPNsense: XPATH Injection can disclose any secret in config.xmlEPSS 0.7%CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.7%CVE-2026-58390HIGHOPNsense: Stored XSS to root RCE via OpenVPN client common_name in status viewsEPSS 0.6%