OPNsense EUVD-2026-102132

Exploitation requires an authenticated OPNsense user who already holds the page-services-ntp-gps privilege to store a malicious initcmd value on the NTP GPS page (src/www/services_ntpd_gps.php); because the value is HTML-escaped before base64_decode(), the decoded markup reaches the textarea output sink unescaped and can close the <textarea> and inject script. Exploitation is further gated by required user interaction (UI:R): a second user - typically an administrator - must subsequently open the NTP GPS page for the stored script to execute. Limiting factors that reduce real-world risk: a privileged (non-default, operator-level) account is a prerequisite, the OPNsense web GUI is normally restricted to an internal/management network rather than the public internet, and the payload only fires on victim visit to that specific page.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in OPNsense's NTP GPS configuration page, scored CVSS 5.4 via CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. The signals are internally consistent and point to a moderate, access-gated risk rather than a mass-exploitation emergency: AV:N with AC:L makes delivery easy, but PR:L means the attacker must already hold an authenticated account with the specific page-services-ntp-gps privilege, and UI:R means a second user must later open the GPS page for the payload to fire - both meaningful brakes on real-world exploitation. The S:C (scope change) and C:L/I:L correctly reflect that injected script executes in the victim's authenticated browser session (a different security authority), where it can steal CSRF tokens and perform actions up to administrator level - a realistic privilege-escalation path from a limited operator to full admin. No EPSS score, KEV listing, or public POC was supplied in the intelligence, so there is no evidence of active exploitation; the risk is primarily insider/second-order (a low-privileged operator targeting an admin) rather than internet-wide. Note the apparent tension between AV:N and the practical reality that OPNsense management interfaces are typically not internet-exposed - on a hardened deployment the real attack surface is the internal/management network, so AV:N somewhat overstates reachability. Net: a legitimate issue worth patching, but lower priority than an unauthenticated RCE.

A low-privileged OPNsense operator who holds the page-services-ntp-gps privilege enters a crafted initcmd value that breaks out of the GPS initialization textarea and injects JavaScript, which is stored in the configuration. When an administrator later opens the NTP GPS page, the script runs in their session, reads CSRF material, and silently performs administrator-level actions on the firewall. No public exploit code was identified in the provided intelligence, but the flaw is well-characterized in the vendor advisory and patch commits.