The flaw in OPNsense allows an attacker to inject carriage-return and line-feed characters into the login username field of the WebGUI authentication page. These CRLF sequences survive LOG_AUTH processing and are interpreted by the syslog-ng lockout handler as separate authentication events. By forging a login failure for another IP address, the attacker can cause that address to be added to the sshlockout PF table, immediately terminating all active sessions for that IP and effectively denying access to any services running behind that address. Conversely, forging an accepted event can reset the attacker’s own brute-force counter, bypassing the configured lockout mechanism. The net effect is a denial of service and the ability to subvert password-guessing protection without any authentication.

Vendors: OPNsense (core). The vulnerability exists in all releases prior to version 26.1.11, affecting the WebGUI login interface that passes raw username input to LOG_AUTH and subsequently to syslog-ng. Clients that rely on the default firewall, VPN, or monitoring services may be impacted if the forged IP address is one that normally routes critical traffic.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild; the vulnerability is also not listed in the CISA KEV catalog. Nonetheless the attack requires only unauthenticated network access to the WebGUI login page, which is typically reachable over the management network. Because an attacker can block vital IPs or reset lockout counters without authentication, the risk to infrastructure remains significant, especially for exposed or poorly segregated management interfaces.