OPNsense CVE-2026-119425

Requires (1) OPNsense captive portal configured with the roaming feature enabled (roaming = 1 on the zone); (2) network position on the same Layer-2 broadcast segment as the portal clients, so forged gratuitous ARP/hostwatch observations are accepted; and (3) an existing authorized victim session whose MAC the attacker can claim. Exploitation is limited by these factors: it is NOT remotely exploitable across routed boundaries (Layer-2 adjacency only), it provides no benefit if roaming is disabled, and the demonstrated outcome is inheritance of an existing authorized session rather than minting a session from nothing. No user interaction or authentication is needed once these conditions hold. IPv6/NDP exploitation was not separately tested by the vendor.

This is a moderate, conditionally-exploitable issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N, score 5.3) is internally consistent with the mechanism: exploitation requires Layer-2 adjacency (AV:A), is low-complexity, needs no authentication (PR:N) and no user interaction, and yields only low confidentiality and low integrity impact (unauthorized portal access and traffic/quota misattribution - not code execution or data compromise). No KEV listing is present, so this is NOT confirmed actively exploited. No EPSS score was supplied, so statistical exploitation likelihood cannot be quantified from the input. A public research write-up (abraxaslabs.tech) and a VulnCheck advisory are referenced, but the input does not mark a confirmed working PoC; a public PoC reference exists, but it is not verified as working exploit code. No SSVC exploitation/automatable/technical-impact decomposition was provided - only the vuln.today 'this_month' priority label, which aligns with a patch-this-cycle posture rather than act_now/emergency. The practical risk ceiling is bounded by two hard limits: the attacker must be on the same broadcast domain, and the captive portal 'roaming' feature must be enabled. Net: a credible insider/guest-network threat worth patching on a normal cycle, not a remotely-exploitable internet-facing critical.

On a guest or hotspot network where OPNsense captive portal roaming is enabled, an unauthenticated attacker sharing the same Layer-2 segment sends forged gratuitous ARP replies that bind the attacker's own IP to the MAC address of an already-authorized client. At the next captive portal background synchronization, OPNsense copies the attacker's IP into the victim's session and PF authorization table, granting the attacker portal access with network usage and quotas attributed to the victim. A public research write-up describes this technique; the input does not confirm packaged working exploit code.