DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
OPNsense: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-07-01
Ein Angreifer kann mehrere Schwachstellen in OPNsense ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Cross-Site Scripting Angriff durchzuführen, um Dateien zu manipulieren, um Informationen offenzulegen, und um einen Denial of Service Angriff durchzuführen.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-71490US | —OT erhöht | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege() appends a directly assigned comma-separated <priv> value as one strin… | ||||
| CVE-2026-63442US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts carriage-return and line-feed characters t… | ||||
| CVE-2026-58395US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an u… | ||||
| CVE-2026-58394US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array f… | ||||
| CVE-2026-58393US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and ope… | ||||
| CVE-2026-58392US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html… | ||||
| CVE-2026-58391US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title… | ||||
| CVE-2026-58390US | — | — | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js… | ||||
| CVE-2026-57155US | — | Exploit | ||
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scri… | ||||
| CVE-2026-57154US | — | — | ||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitHub Security Advisory GHSA-2m9v-p7r9-gfcw vom 2026-07-01external
- GitHub Security Advisory GHSA-2v2x-m4j7-76pv vom 2026-07-01external
- GitHub Security Advisory GHSA-2xrm-p255-p43h vom 2026-07-01external
- GitHub Security Advisory GHSA-8pgr-x852-qx4j vom 2026-07-01external
- GitHub Security Advisory GHSA-98h6-479q-9q3w vom 2026-07-01external
- GitHub Security Advisory GHSA-fq94-cxvc-9r7w vom 2026-07-01external
- GitHub Security Advisory GHSA-h793-67jm-j4m5 vom 2026-07-01external
- GitHub Security Advisory GHSA-p9pr-782r-w2xw vom 2026-07-01external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan