Live › vulnerability › CVE-2026-119424
OPNsense core before 26.7.8 does not strip carriage return and line feed characters from wireless WPA fields. A user with wireless-edit privilege can append arbitrary wpa_supplicant or hostapd directives that root-run daemons then load.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Only OPNsense installs before 26.7.8 that have users with wireless-edit privilege are exposed, since those users can write the WPA identity, passphrase or RADIUS shared secret fields. Firewalls where wireless is not configured or where wireless editing is restricted to fully trusted administrators carry lower practical risk but should still be updated.
No product ranges from the sources yet.
opnsense-version; versions below 26.7.8 are in the stated range.26.7.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.
This page as .md · .json · in your agent: get_signal("CVE-2026-119424")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.