Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in OPNsense firewall and routing platforms, allowing authenticated attackers to overwrite system files with root privileges by manipulating network time protocol settings. This could potentially lead to system compromise. The main concern is confirming relevance and exposure within your deployed OPNsense instances.
- Path traversal in NTP configuration allows file overwrites.
- Critical on internet-facing network edge devices.
- Confirm OPNsense relevance and exposure.
Attack Path
How an attacker could exploit the issue
An attacker with administrative access to the firewall's NTP configuration can exploit a path traversal vulnerability. By carefully crafting parameters related to GPS or PPS serial ports, the attacker can trick the system into writing arbitrary data to any file on the filesystem, ultimately gaining root-level control.
- Authenticated access to NTP configuration required.
- Path traversal via serial port parameters.
- Allows arbitrary file overwrite as root.
Live Threat
Current exploitation, exposure, and threat context
An attacker with administrative access to the NTP configuration module could overwrite arbitrary system files as the root user by manipulating GPS or PPS serial port parameters. This could allow an attacker to modify critical system files or deploy malicious code when supported by the advisory.
- System files could be overwritten.
- Manipulating NTP configuration parameters.
- Potential for system compromise.
Operational Fix
Recommended remediation, mitigation, and detection steps
This critical vulnerability in OPNsense affects its NTP configuration module, allowing authenticated attackers to overwrite arbitrary files as root. Given OPNsense's role as a firewall and routing platform, likely deployed at network perimeters, the platform or infrastructure teams are typically responsible for its management and security. The immediate priority is to identify all OPNsense deployments, determine their exposure and criticality, and confirm ownership before planning remediation.
- Platform and Infrastructure teams own the fix.
- Verify NTP configuration reachability and criticality.
- Plan remediation during the next maintenance window.
