Vulnerability Description
OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://abraxaslabs.tech/research/opnsense-lockout-factory-ip
- https://github.com/opnsense/core
- https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsen
- https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout
- https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68
- https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410
- https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv
- https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-plan
FAQ
What is CVE-2026-119423?
CVE-2026-119423 is a vulnerability with a CVSS score of 5.3 (MEDIUM). OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login username...
How severe is CVE-2026-119423?
CVE-2026-119423 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119423?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.