CVE-2026-119425mediumCWE-290

CVE-2026-119425: falha de média gravidade em opnsense core

OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

Publicada em

Seguir esta CVE+ Monitorar core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
opnsense · core
CVEs relacionadas — opnsense core

No mesmo produto, das mais perigosas para as menos.

CVE-2026-44194CRITICALOPNsense: RCE on user managmentEPSS 5.7%CVE-2026-119409HIGHOPNsense before 26.7.8 Root Command Injection via Firmware Mirror SettingEPSS 2.5%CVE-2026-57155CRITICALOPNsense: Root RCE via Arbitrary File Write in GeoIP Alias ImporterEPSS 0.9%CVE-2026-53582HIGHOPNsense: XPATH Injection can disclose any secret in config.xmlEPSS 0.7%CVE-2026-44193CRITICALOPNsense: RCE via XMLRPC endpoint using `opnsense.restore_config_section` methodEPSS 0.7%CVE-2026-58390HIGHOPNsense: Stored XSS to root RCE via OpenVPN client common_name in status viewsEPSS 0.6%