OPNsense EUVD-2026-113803

No special conditions beyond network reachability - unauthenticated remote exploitation works against default configurations of OPNsense core (the lockout_handler brute-force daemon is always active and the syslog-ng program() destination ships without flags(syslog-protocol)). The attacker needs only HTTP access to the WebGUI /index.php login page and a valid CSRF token fetched from that page; no credentials are required (PR:N). Limiting factors: the attacker must be able to reach the WebGUI login interface (so management-plane exposure governs reach), impact is confined to availability - forced blocking of attacker-chosen IPs and brute-force-counter reset, not code execution or data access - and affected builds are OPNsense core before 26.7.8 (with the appended note indicating backported fixes on other branches).

All exploitability signals point one direction: the vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated attack with no user interaction, and the GHSA advisory confirms this is reachable against a default install because lockout_handler is always active. The only base impact is availability (VA:L; VC:N/VI:N/VA:L), which is consistent with the described effect - forced IP blocking and killing of pf states rather than code execution or data disclosure - yielding a medium 6.9 score. No EPSS score was provided in the input, so exploitation-probability cannot be weighed; this is a gap, not a low score, and should not be read as 'low likelihood.' The CVE is NOT listed in CISA KEV in the supplied data, so there is no evidence of active exploitation; however, a detailed, lab-verified public PoC reference exists in the vendor advisory (including exact payload and verification commands), so weaponization is trivial for a motivated attacker. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the picture of an easily-exploited but availability-only, non-RCE issue. Net: a real and credible unauthenticated remote DoS / brute-force-bypass worth patching on a normal priority cycle rather than an emergency, with the caveat that missing EPSS and the availability-only impact are the main things tempering urgency.

An unauthenticated attacker who can reach the OPNsense WebGUI login page submits a handful of login requests (as few as 2, per the advisory's 6-entry math against the default threshold of 5) whose 'usernamefld' value carries a CRLF-injected fragment mimicking a 'Web GUI authentication error ... from <victim-IP>' event. The lockout_handler parses the forged line, extracts the attacker-chosen IP, and after the threshold runs 'pfctl -t sshlockout -T add <victim-IP>' plus 'pfctl -k' - blocking an arbitrary address (e.g. 8.8.8.8, the upstream gateway, or an admin host) and tearing down its firewall states. A detailed, lab-tested public PoC reference exists in the vendor GHSA advisory; it is not independently verified as working exploit code here.