جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim.

• https://github.com/opnsense/core/security/advisories/GHSA-864r-q4j5-5mjq vendor-advisory
• https://github.com/opnsense/core/commit/f46836d0c3d14e26d79214009bfbfa9a1eecab55 patch
• https://github.com/opnsense/core/commit/32dc2a3e52eefef5251077f315a0f3243eedb834 patch
• https://github.com/opnsense/core/blob/26.7.7/src/opnsense/scripts/captiveportal/cp-background-process.py#L78 technical-description
• https://abraxaslabs.tech/research/opnsense-captive-lastseen-roam third-party-advisory
• https://github.com/opnsense/core product
• https://www.vulncheck.com/advisories/opnsense-26.1.6-through-26.7.7-captive-portal-session-takeover-via-forged-arp third-party-advisory