OPNsense CVE-2026-53581
CRITICALSeverity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
Network-reachable web UI with low complexity but requires admin config access (PR:H); root arbitrary file write escapes app scope (S:C) and enables full integrity/availability and code-exec-driven confidentiality impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.
AnalysisAI
Arbitrary file write as root in OPNsense's NTP configuration module (opnsense/core before 26.1.9 and BE/opnsense/core before 26.4_20) lets an administrator-level attacker escape the intended directory via a crafted GPS or PPS serial-port parameter and overwrite any file on the FreeBSD-based firewall. Because writes occur as root, this path traversal is a strong primitive for full device compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated session with access to the OPNsense NTP configuration module (administrative/operator-level GUI access - consistent with CVSS PR:H), and the specific input is the GPS or PPS serial-port parameter, which the attacker sets to a directory-traversal value. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H, 9.0) is internally consistent with the description: network-reachable web UI, low complexity, but PR:H because the attacker must already hold access to the NTP configuration - i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade opnsense/core to 26.1.9 or later, and BE/opnsense/core to 26.4_20 or later, per GHSA-872g-g543-j37m (https://github.com/opnsense/core/security/advisories/GHSA-872g-g543-j37m). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all OPNsense deployments to identify those running opnsense/core versions before 26.1.9 or BE versions before 26.4_20 using the Diagnostics > System > Firmware menu or command-line version checks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today