The vulnerability allows an authenticated user with the page-services-ntp-gps or PPS privilege to embed newline characters in the fudge or refid fields used by the NTP daemon. By doing so, the attacker can append arbitrary ntpd.conf directives that are then parsed and executed by ntpd, which runs as root. This capability effectively grants the attacker the ability to modify NTP behavior or potentially execute system commands with elevated privileges through the NTP configuration file. The weakness is a classic input validation flaw, identified as CWE‑93.

OPNsense core versions 26.7.8 and earlier are affected. Administrators should be aware that any OPNsense installation running a vulnerable version may expose the NTP service to unauthorized configuration changes.

The CVSS score of 6.0 places the issue in the moderate severity range. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV. The attack requires valid credentials with specific privileges and leverage of the web interface, but once achieved it yields root-level effects. Even with moderate exploitation likelihood, the impact of unauthorized NTP configuration warrants immediate attention.