OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated…
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Opnsense
- Product
- core
- CVSS v3.1
- 5.4 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-290
- Exposure class
- Edge / VPN / firewall
- NVD status
- Received
Why it ranks 17 (Routine)
- CVSS v3.1 5.4 medium
- Exposed product class: edge / VPN / firewall
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.