CVE-2026-58392: OPNsense NTP GPS XSS Vulnerability

CVE-2026-58392 Overview

CVE-2026-58392 is a stored cross-site scripting (XSS) vulnerability in OPNsense, a FreeBSD-based firewall and routing platform. The flaw affects the NTP GPS configuration page in src/www/services_ntpd_gps.php prior to version 26.1.11. Operator-supplied initcmd values are stored in base64 form, escaped with legacy_html_escape_form_data() on the encoded string, and then decoded via base64_decode() directly into the GPS initialization-command textarea. Because decoding occurs after escaping, injected HTML reaches the output sink unescaped. A user with the page-services-ntp-gps privilege can store script that executes in the browser of any user who later opens the GPS page.

Critical Impact
Stored script executes in an administrator's session, allowing attackers to read CSRF tokens and perform authenticated actions up to administrator privilege level.

Affected Products

OPNsense versions prior to 26.1.11
OPNsense NTP GPS configuration component (services_ntpd_gps.php)
OPNsense ntpd.inc plugin handling GPS initialization strings

Discovery Timeline

2026-10-15 - CVE-2026-58392 published to NVD
2026-10-15 - Last updated in NVD database
Fixed in version 26.1.11 - Vendor releases patch via GitHub commits a92d9514 and ed04a154

Technical Details for CVE-2026-58392

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw [CWE-79] in the NTP GPS settings page. OPNsense accepts a GPS initialization command string from authenticated users with the page-services-ntp-gps privilege. The application base64-encodes the value before storage, applies HTML escaping to the already-encoded blob, then decodes the base64 directly into the HTML textarea at render time. Escaping the encoded form produces no useful sanitization, because the decode step reconstitutes any raw HTML or script content afterward. An attacker supplies a payload that closes the <textarea> tag and injects script, which executes in the session of any administrator who subsequently loads the page.

Root Cause

The root cause is improper output encoding ordering. The sanitization pipeline runs legacy_html_escape_form_data() against the base64-encoded ciphertext rather than the decoded plaintext that reaches the DOM. Because base64 output contains no HTML metacharacters, the escape function is effectively a no-op. The subsequent base64_decode() call reintroduces the original characters, including </textarea> and <script> sequences, into the rendered page.

Attack Vector

An authenticated low-privilege user holding the page-services-ntp-gps ACL writes a crafted initcmd value through the GPS settings form. The payload persists in config.xml under ntpd/gps/initcmd. When an administrator later browses to the GPS page, the stored script runs in their authenticated session. The attacker can harvest CSRF tokens, call privileged endpoints, create accounts, modify firewall rules, or escalate to full administrative control over the appliance.

php

// Patched behavior in src/www/services_ntpd_gps.php
                $gps[$fieldname] = $pconfig[$fieldname];
            }
        }
-       $gps['initcmd']= base64_encode($gps['initcmd']);
+       $gps['initcmd']= base64_encode($gps['initcmd'] ?? '');
        $config['ntpd']['gps'] = $gps;
        write_config("Updated NTP GPS Settings");
        ntpd_configure_do();

Source: OPNsense commit a92d9514

Detection Methods for CVE-2026-58392

Indicators of Compromise

Unexpected HTML or script tokens in the ntpd/gps/initcmd element of config.xml after base64 decoding
Administrator sessions issuing privileged API calls immediately after loading services_ntpd_gps.php
Audit log entries showing page-services-ntp-gps users modifying GPS settings without a legitimate hardware change
New administrative accounts or firewall rule changes correlating with GPS page visits

Detection Strategies

Decode the stored initcmd value and inspect for <, >, script, or </textarea> substrings that fall outside NMEA PUBX command syntax
Review web server access logs for POST requests to /services_ntpd_gps.php from non-administrator accounts
Correlate GPS page GETs by administrators with subsequent state-changing POST requests in the same session window

Monitoring Recommendations

Monitor OPNsense configuration history and diff ntpd/gps entries after every change
Alert on assignment of the page-services-ntp-gps privilege to non-administrative users
Capture and review browser Content Security Policy violation reports from the OPNsense web UI

How to Mitigate CVE-2026-58392

Immediate Actions Required

Upgrade OPNsense to version 26.1.11 or later
Audit the ntpd/gps/initcmd configuration value and reset it to the default if any non-NMEA content is present
Review the list of accounts holding the page-services-ntp-gps ACL and remove assignments that are not operationally required
Rotate administrator credentials and invalidate active web UI sessions if tampering is suspected

Patch Information

The fix is included in OPNsense 26.1.11. The vendor patched both src/www/services_ntpd_gps.php and src/etc/inc/plugins.inc.d/ntpd.inc to safely handle the initcmd value. Review the GitHub Security Advisory GHSA-h793-67jm-j4m5 and the fix commits a92d9514 and ed04a154 for complete technical details.

Workarounds

Restrict the page-services-ntp-gps privilege to trusted administrators only until the patch is applied
Disable GPS reference clock configuration if it is not used in the environment
Enforce multi-factor authentication for all OPNsense web UI accounts to reduce the blast radius of session hijacking

bash

# Verify installed OPNsense version and upgrade
opnsense-version
opnsense-update -ur

# Inspect stored GPS init command for injected markup
grep -A1 '<initcmd>' /conf/config.xml | tail -n +2 | base64 -d