CVE-2026-119424— OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

Quick assessment

Affected

opnsense core

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

26.7.8 版本之前的 OPNsense 核心存在配置行注入漏洞。拥有无线编辑（wireless-edit）权限的已认证用户，可通过在 WPA 相关字段中嵌入回车/换行（CR/LF）字符来注入指令。攻击者可在、或 RADIUS 共享密钥中插入换行符，从而向由 root 用户运行的守护进程（如或）追加任意配置指令。

CVSS 6.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1548.001 · Setuid and Setgid T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity

Source: CVE Program / CVE List V5

Vulnerability Description

OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对CRLF序列的转义处理不恰当(CRLF注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
opnsense	core	0 ~ 26.7.8	-

II. Public POCs for CVE-2026-119424

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119424

请登录查看更多情报信息。

Other References for CVE-2026-119424 (5)

🔗 Interfaces: Wireless: Devices - stricten input a bit further, small c… · opnsense/core@3bbd714 · GitHub patch
🔗 GitHub - opnsense/core: OPNsense GUI, API and systems backend · GitHub product
https://abraxaslabs.tech/research/opnsense-wlan-wpa-line third-party-advisory
🔗 core/src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml at 26.7.7 · opnsense/core · GitHub technical-description
🔗 OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119424

Same Patch Batch · opnsense · 2026-10-30 · 5 CVEs total

CVE-2026-119409	7.2 HIGH	OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
CVE-2026-119560	5.9 MEDIUM	OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
CVE-2026-119425	5.4 MEDIUM	OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
CVE-2026-119423	5.3 MEDIUM	OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username

IV. Related Vulnerabilities

Same product: core

Same vendor: opnsense

Same weakness: CWE-93