Logo
Retour à la veille

CVE-2026-119424

Publié : 30 octobre 2026
Modifié : 30 octobre 2026
Lien officiel NVD
Score CVSS
6.8
MEDIUM

Description détaillée

OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Références et Patchs

https://abraxaslabs.tech/research/opnsense-wlan-wpa-linehttps://github.com/opnsense/corehttps://github.com/opnsense/core/blob/26.7.7/src/etc/inc/interfaces.inc#L1901https://github.com/opnsense/core/blob/26.7.7/src/opnsense/mvc/app/models/OPNsense/Interfaces/Wlan.xml#L185https://github.com/opnsense/core/commit/3bbd714b4c4b60f164e2e908501f208d3eadf645https://github.com/opnsense/core/commit/9f1eac0f9bdf705766ab61f9d62b9d55757fd0dahttps://www.vulncheck.com/advisories/opnsense-before-26.7.8-wireless-wpa-configuration-line-injection-via-identity

Dernières Vulnérabilités

CVE-2026-91915

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.

VOIR DÉTAILS

CVE-2026-91914

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Authentication Bypass by Spoofing vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Session theft.

VOIR DÉTAILS

CVE-2026-91913

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

VOIR DÉTAILS