OPNsense CVE-2026-63442

Requires unauthenticated network reachability to the OPNsense WebGUI login page (the usernamefld parameter) on a version prior to 26.1.11, with the syslog-ng lockout pipeline (syslog-ng-lockout.conf feeding lockout_handler) active - this is the default login-protection path on OPNsense core, so no non-default feature toggle is needed. Limiting factors: the CVSS AV:A rating indicates exploitation presumes adjacent/management-network access to the GUI, so deployments that properly restrict the WebGUI to a trusted management segment sharply reduce exposure; no authentication (PR:N) and no user interaction (UI:N) are required once the login page is reachable. Impact is bounded to integrity of the lockout state and availability (blocking admin/DNS/gateway/monitoring IPs and killing their PF states, or resetting brute-force counters); there is no confidentiality impact (C:N).

This is a genuine, well-substantiated integrity/availability flaw rather than a CVSS-inflated issue, though it is not an emergency. The CVSS 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) reflects an unauthenticated, low-complexity attack with high integrity and availability impact and no confidentiality exposure - consistent with a log-injection (CWE-117) bug that manipulates the sshlockout decision pipeline rather than leaking data. The vendor rates attack vector as Adjacent (AV:A), which is meaningful: it implies exploitation presumes reachability of the OPNsense WebGUI login page, which in sane deployments is restricted to a management/LAN segment, not the internet. Note a tension worth verifying: the description says 'An attacker with network access to the login page,' which reads broader than 'adjacent' - if the WebGUI is exposed to a wider network, real-world reach is larger than AV:A suggests; verify management-interface exposure per deployment. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so there is no evidence of active exploitation or mass-scanning pressure; this suggests prioritizing it as a high-value patch for internet- or multi-tenant-exposed firewalls but not a drop-everything KEV-tier event. The absence of EPSS/KEV/POC is a data gap (not a safety signal) and should not be read as 'low exploitation likelihood' with confidence.

An attacker able to reach the OPNsense WebGUI login page submits a login attempt whose username field contains carriage-return/line-feed characters plus a forged log fragment naming a chosen IP. The injected fragment survives LOG_AUTH/syslog-ng processing and is parsed by lockout_handler as a separate authentication event, letting the attacker either force a victim IP (admin, DNS, gateway, or monitoring host) into the sshlockout PF table and drop its active states, or forge an 'accepted' event to reset their own brute-force lockout counter. No public exploit code was identified at time of analysis, but the mechanism is fully disclosed in the vendor advisory and fix commits.