{"id":"CVE-2026-119423","aliases":[],"cve":{"records":[{"id":"CVE-2026-119423","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-30T02:41:13.241Z","published":"2026-10-30T11:30:53.650Z","modified":"2026-11-04T15:05:35.901Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-10-30T11:30:53.650Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-04T15:05:35.901Z"}],"references":[{"url":"https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv","tags":["vendor-advisory"],"source":"VulnCheck"},{"url":"https://abraxaslabs.tech/research/opnsense-lockout-factory-ip","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/opnsense/core","tags":["product"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-117","description":"Improper Output Neutralization for Logs","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:opnsense:opnsense:*:*:*:*:*:*:*:*","versionEndExcluding":"26.7.8"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-04T15:05:24.381582Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the lockout_handler by submitting crafted WebGUI login usernames. Attackers can submit usernames like 'Invalid user <victim-ip>' repeatedly to add the victim to the sshlockout table, blocking SSH and WebGUI access and killing its pf states.","score":6.9,"severity":"medium","published":"2026-10-30T11:30:53.650Z","modified":"2026-11-04T15:05:35.901Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"opnsense","name":"core","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"26.7.8","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:github/opnsense/core","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-119423"}],"remediation":[],"references":["https://github.com/opnsense/core/commit/14f8f7dd1d5f06522d60794a7beeac7adb9eca68","https://github.com/opnsense/core/commit/2076f2c195bf9537ec220f0e5d6aff998f057410","https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/library/OPNsense/Auth/AuthenticationFactory.php#L232","https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/syslog/lockout_handler#L70","https://github.com/opnsense/core/security/advisories/GHSA-2v2x-m4j7-76pv","https://abraxaslabs.tech/research/opnsense-lockout-factory-ip","https://github.com/opnsense/core","https://www.vulncheck.com/advisories/opnsense-core-before-26.7.8-lockout-ip-planting-via-webgui-login-username"],"sources":[{"name":"CVE","id":"CVE-2026-119423","modified":"2026-11-04T15:05:35.901Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119423"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-04T15:24:43.132Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:25:34.584Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-04T15:55:39.910Z","attemptedAt":"2026-11-04T15:55:39.910Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-04T15:55:40.410Z","attemptedAt":"2026-11-04T15:55:40.410Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-04T15:55:40.631Z","attemptedAt":"2026-11-04T15:55:40.631Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-04T15:55:39.999Z","attemptedAt":"2026-11-04T15:55:39.999Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119423","modified":"2026-11-04T15:17:40.293","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-04T15:55:39.910Z"},{"source":"NVD","id":"CVE-2026-119423","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119423","modified":"2026-11-04T15:17:40.293","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-04T15:55:39.910Z"},{"source":"FIRST EPSS","id":"CVE-2026-119423","url":"https://www.first.org/epss/","probability":0.00376,"percentile":0.31724,"date":"2026-11-04","checkedAt":"2026-11-04T15:55:39.999Z"},{"source":"GitHub Advisory Database","id":"GHSA-m68j-m67p-c39j","url":"https://github.com/advisories/GHSA-m68j-m67p-c39j","modified":"2026-10-30T12:31:25Z","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","checkedAt":"2026-11-04T15:55:40.410Z"},{"source":"ENISA EUVD","id":"EUVD-2026-113803","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113803","modified":"Oct 30, 2026, 11:30:53 AM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","checkedAt":"2026-11-04T15:55:40.631Z"}],"aiSummary":{"text":"OPNsense core before 26.7.8 has a log injection vulnerability, allowing unauthenticated attackers to block SSH and WebGUI access by submitting crafted login usernames. The weakness is due to improper output neutralization for logs. This can kill pf states.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T11:46:31.655Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-119423"}]}}