OPNsense core NTP Configuration Path Traversal Enables Root-Level Arbitrary File Overwrite

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue.

• opnsense/core: affected through 26.1.8; the vendor advisory identifies 26.1.9 as the fixed release. • BE/opnsense/core: the vendor advisory identifies versions through 26.4_14 as affected and 26.4_20 as the fixed release. • These boundaries are branch-specific and should not be merged into one general range. The status of parallel branches or versions outside the explicitly confirmed ranges is not established by the available evidence.

The vulnerability is in the NTP configuration module, specifically the ntpd_configure_gps() and ntpd_configure_pps() functions in src/etc/inc/ntpd.inc. When NTP is configured to use a GPS device, the user-supplied serial port value derived from $config['ntpd']['gps']['port'] is concatenated directly with the /dev/ path without normalization or validation. This allows traversal elements in the port value to escape the intended directory and cause the system to write attacker-controlled data to another file. The attacker must have access to NTP configuration and control the serial port parameter; the record describes a network-reachable attack with low complexity and no additional user interaction, but high required privileges. The vendor advisory states that the target file in the proof of concept must already exist. The implementation details of the patch and the full set of affected configurations are not disclosed.

The vulnerability is reachable through the management plane when an attacker has access to NTP configuration. Exploitation requires high privileges, does not require interaction from another user, and is not described as depending on a complex environmental condition. The developer advisory includes a public proof of concept for file overwriting, but this entry does not reproduce payloads or exploit strings. The available evidence confirms a public proof of concept but does not document exploitation in a named campaign, victim environment, or breach.

Successful exploitation permits arbitrary file overwriting with root privileges, beyond the logical scope of the NTP configuration module. The vendor advisory describes the result as capable of leading to total system compromise; the actual outcome depends on which existing file is targeted and what content is written. Possible effects include modification of firewall or routing configuration, loss of access control, service disruption, and exposure of data or credentials. The flaw is not exploitable by every user because high-privilege access to NTP configuration is still required, and the demonstrated proof of concept requires an existing target file.

• Root-level file overwriting can undermine the integrity of a firewall and routing appliance, including administrative configuration or service-control components. • If a sensitive file is targeted, possible consequences include altered access policy, service disruption, data exposure, or conditions that support continued unauthorized access. These are possible consequences, not a confirmed incident in a specific environment. • Because OPNsense is commonly deployed at network boundaries, compromise of an affected appliance could extend to the networks and services it protects. • Exploitation still requires high-privilege access to NTP configuration, which limits the eligible attacker population but does not remove the risk from exposed management interfaces or compromised administrator accounts.

1. Upgrade opnsense/core to the fixed release 26.1.9 when the system is on the corresponding branch. For BE/opnsense/core, upgrade to the fixed release 26.4_20. These are branch-specific fixed points and should not be treated as evidence that every other branch is covered.
2. Until the upgrade is complete, restrict access to the administrative interface and NTP configuration to trusted administrators. This is temporary risk reduction and does not replace the fix.
3. After upgrading, review NTP configuration, system-file integrity, and administrative change history on systems where untrusted or broadly distributed accounts could access NTP configuration.
4. If sensitive files may have been overwritten, isolate the system for investigation and rotate credentials that could have been affected. The investigation should account for the advisory's limitation that the demonstrated target file must already exist.

1. Inventory OPNsense systems and identify the versions of opnsense/core and BE/opnsense/core, then compare them with the affected and fixed boundaries in affected_summary.
2. Identify systems with GPS or PPS enabled for NTP and inspect the serial port values for unexpected path components or path traversal indicators.
3. Review NTP configuration change history and administrative audit records, where available, as a precautionary monitoring measure; the evidence does not provide a specific log signature or IOC.
4. Check the integrity of existing system and security-sensitive configuration files after suspicious NTP changes, because the proof of concept requires the target file to already exist.
5. Failure to find a suspicious setting or log entry does not prove that a system is safe; confirm that the deployed branch contains the fix.