CVE-2026-53581: OPNsense NTP Path Traversal Vulnerability

CVE-2026-53581 Overview

CVE-2026-53581 is a path traversal vulnerability [CWE-22] in the OPNsense Network Time Protocol (NTP) configuration module. OPNsense is a FreeBSD-based firewall and routing platform used to protect network perimeters. An authenticated attacker with access to the NTP configuration can manipulate the GPS or Pulse-Per-Second (PPS) serial port parameter to escape the intended directory. The manipulation forces the system to write attacker-controlled data to arbitrary files as the root user. Versions prior to 26.1.9 of opnsense/core and 26.4_20 of BE/opnsense/core are affected.

Critical Impact
Authenticated attackers can overwrite arbitrary files on the firewall as root, enabling full system compromise of the perimeter security device.

Affected Products

OPNsense opnsense/core prior to version 26.1.9
OPNsense Business Edition BE/opnsense/core prior to version 26.4_20
FreeBSD-based OPNsense firewall and routing appliances with NTP GPS/PPS configuration exposed

Discovery Timeline

2026-09-08 - CVE-2026-53581 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-53581

Vulnerability Analysis

The vulnerability resides in the NTP configuration module of OPNsense. The module accepts GPS and PPS serial port parameters from authenticated administrators. These parameters are concatenated into file paths without sufficient validation of directory traversal sequences. When the NTP subsystem writes configuration or device state to disk, the process runs with root privileges. An attacker who supplies a crafted serial port value containing ../ sequences can direct the write operation outside the intended directory.

The result is arbitrary file overwrite on the underlying FreeBSD filesystem. An attacker can target system binaries, cron files, sshd configuration, or shell startup scripts to achieve persistence or immediate code execution as root. Because OPNsense functions as a network perimeter device, successful exploitation compromises the trust boundary that segments internal networks from external ones.

Root Cause

The root cause is missing input sanitization on the GPS and PPS serial port parameter fields. The NTP configuration handler treats user-supplied values as trusted path components. It fails to normalize the path or reject sequences that resolve outside the expected serial device directory.

Attack Vector

Exploitation requires network access to the OPNsense web administration interface and credentials with permission to modify NTP settings. The attacker submits a modified NTP configuration containing a traversal payload in the GPS or PPS serial port field. Upon save, the OPNsense backend writes attacker-controlled content to the target path with root privileges. Technical details are available in the GitHub Security Advisory GHSA-872g-g543-j37m.

Detection Methods for CVE-2026-53581

Indicators of Compromise

Unexpected modifications to system files outside /dev/ or the NTP working directory following NTP configuration changes
NTP configuration entries containing ../ sequences or absolute paths in the GPS or PPS serial port fields
New or modified cron jobs, SSH authorized keys, or shell profile scripts owned by root correlated with administrator NTP activity
Web audit log entries showing NTP configuration saves by unusual accounts or from unexpected source addresses

Detection Strategies

Review OPNsense audit logs for NTP configuration changes and inspect submitted GPS/PPS parameter values for traversal characters
File integrity monitoring on the OPNsense host targeting /etc/, /usr/local/etc/, /root/, and cron directories
Alert on any write operations to sensitive paths initiated by the configd or PHP-FPM process handling NTP configuration

Monitoring Recommendations

Enable and forward OPNsense audit and system logs to a centralized logging platform for correlation
Monitor administrative access to the OPNsense web interface, particularly the Services > Network Time menu
Track authentication events for accounts with NTP configuration privileges and flag anomalous session origins

How to Mitigate CVE-2026-53581

Immediate Actions Required

Upgrade opnsense/core to version 26.1.9 or later, and Business Edition BE/opnsense/core to 26.4_20 or later
Restrict web administration interface access to trusted management networks only
Rotate credentials for any account with NTP configuration privileges and audit recent NTP setting changes
Review firewall system integrity for unauthorized file modifications prior to patching

Patch Information

The OPNsense project addressed the vulnerability in opnsense/core version 26.1.9 and Business Edition BE/opnsense/core version 26.4_20. Both releases add input validation to the NTP configuration module to reject path traversal sequences in the GPS and PPS serial port parameters. Refer to the GitHub Security Advisory GHSA-872g-g543-j37m for release details.

Workarounds

Limit administrative accounts with access to the NTP configuration module to a minimal set of trusted operators
Place the OPNsense management interface behind a VPN or bastion host and enforce multi-factor authentication
Audit existing NTP GPS/PPS configuration values and remove any entries containing path traversal characters

bash

# Verify installed OPNsense version and upgrade
opnsense-version
opnsense-update -u