OPNsense Core EUVD-2026-113825

Requires an authenticated OPNsense web UI/API account holding the page-services-ntp-gps or PPS privilege; the attacker submits CR/LF characters in the fudge or refid fields through services_ntpd_gps.php or services_ntpd_pps.php, and must be able to apply/restart the NTP (ntpd) service so the generated /var/etc/ntpd.conf is reloaded. Limiting factors: this is not unauthenticated (a delegated NTP-management privilege is mandatory), it applies only to deployments that use and expose NTP GPS/PPS configuration, and the injected directives take effect only after a service restart/apply.

This is a medium-severity, authenticated privilege-boundary bypass rather than a mass-exploitable remote flaw. The CVSS 4.0 vector (AV:N/PR:L/UI:N, 6.0) confirms the issue is reachable over the network but requires an authenticated account - specifically one holding the delegated page-services-ntp-gps or PPS privilege - so it is not usable by anonymous attackers. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real-but-non-urgent priority. No CISA KEV listing is present and no EPSS score was provided, so there is no signal of active or widespread exploitation; the signals available point to targeted/insider or post-compromise abuse rather than opportunistic mass attacks. A public PoC reference exists in the GHSA advisory, but it demonstrates the related Dnsmasq injection path, not the NTP fudge/refid fields named in this CVE, so a working exploit specific to this vector is not verified. Note a signal conflict worth verifying: the official CVSS 4.0 marks AC:H/AT:P, yet the description portrays a straightforward CR/LF submission with no stated special trigger condition - this analyst assesses the complexity as lower (see assessed vector). The core risk is that a limited NTP-settings operator can escalate to influencing a configuration file loaded by ntpd running as root.

A delegated OPNsense operator whose web UI/API account is restricted to NTP GPS/PPS settings submits a fudge or refid value containing newline (CR/LF) characters via services_ntpd_gps.php or services_ntpd_pps.php, terminating the intended line and appending arbitrary directives to the generated ntpd.conf. After the NTP service is applied/restarted, ntpd loads the injected directives while running as root, letting the limited user affect a root-managed service beyond the setting the GUI intended to expose. A public PoC reference exists in the GHSA advisory (demonstrated against the related Dnsmasq path); it is not verified as working exploit code for the NTP fields specifically.