← Database

CVE-2026-119423

MEDIUM CVSS: 5.3 Published: 2026-10-30 Modified: 2026-10-30

Description

OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user ' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.

Affected Platforms

Unknown

Weakness Type

CWE-117

References