Threats tagged 'ghsa-2h55-2m98-rp29'

OPNsense core versions up to 26.7.8 have a configuration injection vulnerability that allows authenticated users with specific privileges to inject arbitrary directives into the ntpd.conf file. This is achieved by embedding newline characters in the fudge and refid fields via specific PHP service endpoints. The vulnerability affects ntpd running as root, potentially leading to integrity and availability impacts.