Executive brief
OPNsense is a firewall and routing platform based on FreeBSD that protects corporate networks. A critical vulnerability in its NTP configuration module allows administrators or users with limited GUI access to overwrite any file on the system as the root user, potentially compromising the entire firewall and exposing or modifying all network traffic and configuration data.
Technical details
A path traversal vulnerability in the ntpd_configure_gps() and ntpd_configure_pps() functions (src/etc/inc/ntpd.inc) concatenates user-supplied serial port parameters directly with the /dev/ directory without normalization or validation. An attacker with NTP configuration access can inject directory traversal sequences (../) to write arbitrary files, including SSH keys and configuration files, with root privileges. Patches are available in versions 26.1.9 and 26.4_20.
Affected products
- OPNsense OPNsense opnsense/core prior to 26.1.9; BE/opnsense/core prior to 26.4_20
Timeline
- 2026-06-02: disclosed: Vulnerability disclosed on GitHub security advisory
- 2026-09-08: patched: Patched in opnsense/core 26.1.9 and BE/opnsense/core 26.4_20