Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

OPNsense core lets NTP write any file as admin

CVE-2026-53581 · published 1 month ago
Summary

Versions of OPNsense core before the latest updates let someone who can change the time‑sync settings trick the system into writing data to any location on the disk, effectively giving them full control. This happens by misusing the GPS/PPS serial port option to escape the intended folder. Upgrade to the newest OPNsense core release (26.1.9 or later) to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
opnsense core < 26.1.9
Original advisory text
ntp: write path traversal
OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-73External Control of File Name or Path
Timeline
Published8 Sep 2026
Updated11 Oct 2026
First seen8 Sep 2026
Sources
CVE-2026-53581 · NVD
CVE-2026-53581 · MITRE
CVE-2026-53581 · OSV
GHSA-872g-g543-j37m · GHSA
Track software like this
Free during beta