DeutschShown in its original language — a full translation is planned for a future version.
OPNsense: Mehrere Schwachstellen
view advisory published 2026-07-01
Ein Angreifer kann mehrere Schwachstellen in OPNsense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um Dateien zu manipulieren, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-71490US | —OT elevated | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one strin… | ||||
| CVE-2026-63442US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters t… | ||||
| CVE-2026-58395US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an u… | ||||
| CVE-2026-58394US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array f… | ||||
| CVE-2026-58393US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and ope… | ||||
| CVE-2026-58392US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html… | ||||
| CVE-2026-58391US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title… | ||||
| CVE-2026-58390US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js… | ||||
| CVE-2026-57155US | — | Exploit | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scri… | ||||
| CVE-2026-57154US | — | — | ||
02
references
External citations — patches, advisories, analysis.
- GitHub Security Advisory GHSA-2m9v-p7r9-gfcw vom 2026-07-01external
- GitHub Security Advisory GHSA-2v2x-m4j7-76pv vom 2026-07-01external
- GitHub Security Advisory GHSA-2xrm-p255-p43h vom 2026-07-01external
- GitHub Security Advisory GHSA-8pgr-x852-qx4j vom 2026-07-01external
- GitHub Security Advisory GHSA-98h6-479q-9q3w vom 2026-07-01external
- GitHub Security Advisory GHSA-fq94-cxvc-9r7w vom 2026-07-01external
- GitHub Security Advisory GHSA-h793-67jm-j4m5 vom 2026-07-01external
- GitHub Security Advisory GHSA-p9pr-782r-w2xw vom 2026-07-01external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan