Configuration Line Injection Flaw in OPNsense Wireless Functionality by Deciso
CVE-2026-119424

6.1MEDIUM

Key Information:

Vendor

Opnsense

Status
Core
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119424?

A configuration line injection vulnerability was identified in OPNsense core versions prior to 26.7.8, allowing authenticated users with wireless-edit privileges to insert arbitrary directives. This could be achieved by manipulating WPA fields—specifically by embedding CR/LF characters into wpa.identity, wpa.passphrase, or RADIUS shared secrets. Such an injection can result in the addition of unintended wpa_supplicant or hostapd directives, with potential repercussions on network security and functionality.

Affected Version(s)

core 0 < 26.7.8

References

https://github.com/opnsense/core/commit/9f1eac0f9bdf70576...
patch
https://github.com/opnsense/core/commit/3bbd714b4c4b60f16...
patch
https://github.com/opnsense/core/blob/26.7.7/src/opnsense...
technical-description

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
Ad Schellevis
.