Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-119423— OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

Quick assessment

Affected

opnsense core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OPNsense 核心版本在 26.7.8 之前存在日志注入漏洞，未认证的攻击者可通过提交精心构造的 WebGUI 登录用户名，将受害者的 IP 地址植入模块。攻击者可反复提交类似的用户名，从而将受害者 IP 添加至表中，导致其 SSH 和 WebGUI 访问被封锁，并清除其 pf（Packet Filter）状态连接。

CVSS 5.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1499.001 · OS Exhaustion Flood T1499.003 · Application Exhaustion Flood

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

Source: CVE Program / CVE List V5

Vulnerability Description

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

日志输出的转义处理不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
opnsense	core	0 ~ 26.7.8	-

II. Public POCs for CVE-2026-119423

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119423

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-119423 (3)

Vendor Advisories for CVE-2026-119423 (1)

🔗 Log Forgery via Login Username CRLF in WebGUI Authentication → Pf Table IP Blocking · Advisory · opnsense/core · GitHub Read full article vendor-advisory

Vendor Pages for CVE-2026-119423 (2)

Other References for CVE-2026-119423 (1)

https://abraxaslabs.tech/research/opnsense-lockout-factory-ip third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119423

Same Patch Batch · opnsense · 2026-10-30 · 5 CVEs total

CVE-2026-119409	7.2 HIGH	OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
CVE-2026-119424	6.8 MEDIUM	OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
CVE-2026-119560	5.9 MEDIUM	OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
CVE-2026-119425	5.4 MEDIUM	OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP

IV. Related Vulnerabilities

Same product: core

Same vendor: opnsense

Same weakness: CWE-117