{"id":"CVE-2026-119424","kind":"vulnerability","aliases":["CVE-2026-119424"],"related":[],"title":"OPNsense: CR/LF in WPA fields lets authenticated users inject root-run daemon directives","description":"OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.","summary":"OPNsense core before 26.7.8 does not strip carriage return and line feed characters from wireless WPA fields. A user with wireless-edit privilege can append arbitrary wpa_supplicant or hostapd directives that root-run daemons then load.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewall","freebsd","infrastructure","opnsense","wireless"],"not_affected_if":["no-wireless-edit-users","version-26.7.8-or-later"],"how_to_check":"- Check the installed OPNsense version in the web interface or with `opnsense-version`; versions below `26.7.8` are in the stated range.\n- Review users who hold the wireless-edit privilege in System > Access > Users and Groups.","fix":"- OPNsense core: move to `26.7.8` or later.","status":"open","published_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:32:33+00:00","updated_at":"2026-10-30T12:32:33+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-30T12:32:33Z","model":"claude-haiku-5-5","output":{"fix":"- OPNsense core: move to `26.7.8` or later.","reach":"local","title":"OPNsense: CR/LF in WPA fields lets authenticated users inject root-run daemon directives","impact":"high","summary":"OPNsense core before 26.7.8 does not strip carriage return and line feed characters from wireless WPA fields. A user with wireless-edit privilege can append arbitrary wpa_supplicant or hostapd directives that root-run daemons then load.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["opnsense","firewall","wireless","freebsd"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Injected directives run with root privileges on the firewall","analyst_note":"","how_to_check":"- Check the installed OPNsense version in the web interface or with `opnsense-version`; versions below `26.7.8` are in the stated range.\n- Review users who hold the wireless-edit privilege in System > Access > Users and Groups.","plain_action":"","needs_analyst":false,"not_affected_if":["version-26.7.8-or-later","no-wireless-edit-users"],"who_is_affected":"Only OPNsense installs before 26.7.8 that have users with wireless-edit privilege are exposed, since those users can write the WPA identity, passphrase or RADIUS shared secret fields. Firewalls where wireless is not configured or where wireless editing is restricted to fully trusted administrators carry lower practical risk but should still be updated.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000699,"input_tokens":4164,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119424':17A,20A '-2026':16A,19A '26.7.8':29B,68C 'allow':76C 'append':51B,106C 'arbitrari':52B,107C 'attack':94C 'authent':7A,77C 'carriag':33B 'charact':38B,90C 'configur':71C 'contain':69C 'core':27B,66C 'cr/lf':2A,89C 'cve':15A,18A 'daemon':13A,62B,118C 'direct':14A,57B,86C,112C 'edit':48B,82C 'embed':88C 'feed':37B 'field':5A,42B,93C 'firewal':21B 'freebsd':22B 'hostapd':56B,111C 'infrastructur':23B 'inject':9A,73C,85C 'let':6A 'line':36B,72C 'load':64B,113C 'newlin':97C 'opnsens':1A,24B,26B,65C 'place':96C 'privileg':49B,83C 'radius':102C 'return':34B 'root':11A,60B,116C 'root-run':10A,59B,115C 'run':12A,61B,117C 'secret':104C 'share':103C 'strip':32B 'supplic':54B,109C 'user':8A,44B,78C 'vulner':74C 'wireless':25B,40B,47B,81C 'wireless-edit':46B,80C 'wpa':4A,41B,53B,92C,108C 'wpa.identity':99C 'wpa.passphrase':100C","nicknames":[],"mitigations":[],"who_affected":"Only OPNsense installs before 26.7.8 that have users with wireless-edit privilege are exposed, since those users can write the WPA identity, passphrase or RADIUS shared secret fields. Firewalls where wireless is not configured or where wireless editing is restricted to fully trusted administrators carry lower practical risk but should still be updated.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:39+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119424","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119424","severity":null,"published_at":"2026-10-30T12:16:39+00:00","modified_at":"2026-10-30T12:16:39+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}