Stored HTML Injection in OPNsense Firewall's NTP GPS Page

CVE-2026-58392

What is CVE-2026-58392?

OPNsense, a FreeBSD-based firewall and routing solution, has a security flaw in its NTP GPS page affecting versions prior to 26.1.11. The vulnerability stems from the improper handling of user-supplied input, where the initcmd value is stored in base64 format. This value is processed with legacy_html_escape_form_data(), but the decoding occurs after this escaping, resulting in unfiltered HTML being executed in the output. An attacker with adequate privileges can inject malicious scripts that execute in the context of other users' sessions, potentially allowing unauthorized access to sensitive information and actions traditionally reserved for administrators.

References