Search
Find a vulnerability
Search criteria
336 vulnerabilities by OpenWRT
CVE-2026-55606 (GCVE-0-2026-55606)
Vulnerability from nvd – Published: 2026-10-23 13:21 – Updated: 2026-10-23 13:21
VLAI
EPSS
VEX
Title
odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Severity
6.5 (Medium)
CWE
- CWE-126 - Buffer Over-read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/pull/401 | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/6907f28f… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/ed38cffa… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c= 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd\u0027s DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer \u2014 a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126: Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:21:21.038Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45"
},
{
"name": "https://github.com/openwrt/odhcpd/pull/401",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/pull/401"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301"
}
],
"source": {
"advisory": "GHSA-x8x4-7gvf-gp45",
"discovery": "UNKNOWN"
},
"title": "odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55606",
"datePublished": "2026-10-23T13:21:21.038Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-10-23T13:21:21.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53921 (GCVE-0-2026-53921)
Vulnerability from nvd – Published: 2026-10-23 13:20 – Updated: 2026-10-23 13:20
VLAI
EPSS
VEX
Title
odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
Severity
9.8 (Critical)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/0320032a… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/03dacc23… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/2a42d34c… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/6634b7a3… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d168c27f… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d329a154… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd\u0027s DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:20:30.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/03dacc23356b5789842b9d1bba0200fd005e35f3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/03dacc23356b5789842b9d1bba0200fd005e35f3"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/2a42d34c3615e2449ca273f673eee7c429d819a9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/2a42d34c3615e2449ca273f673eee7c429d819a9"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/6634b7a3c79c41a27687925c98c35c8aea2f2b5a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/6634b7a3c79c41a27687925c98c35c8aea2f2b5a"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328"
}
],
"source": {
"advisory": "GHSA-7fwx-hhrg-3496",
"discovery": "UNKNOWN"
},
"title": "odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53921",
"datePublished": "2026-10-23T13:20:30.249Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-23T13:20:30.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53920 (GCVE-0-2026-53920)
Vulnerability from nvd – Published: 2026-10-23 13:20 – Updated: 2026-10-23 20:58
VLAI
EPSS
VEX
Title
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 17:33 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/719fc3ab… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/f2275efc… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T17:33:12.791918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:58:10.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003e= 17.01.0, \u003c 25.12.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd\u0027s DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia-\u003eiaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd\u0027s 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126: Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:20:48.045Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42"
}
],
"source": {
"advisory": "GHSA-p769-5v73-pc4f",
"discovery": "UNKNOWN"
},
"title": "odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53920",
"datePublished": "2026-10-23T13:20:48.045Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-23T20:58:10.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53918 (GCVE-0-2026-53918)
Vulnerability from nvd – Published: 2026-10-23 13:21 – Updated: 2026-10-23 13:21
VLAI
EPSS
VEX
Title
odhcpd DHCPv6 IA dangling first pointer use-after-free
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.
Severity
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/26b12200… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/5b283832… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd\u0027s DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first-\u003ekey`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-672",
"description": "CWE-672: Operation on a Resource after Expiration or Release",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "CWE-825: Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:21:00.665Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9"
}
],
"source": {
"advisory": "GHSA-44ff-jcwh-wgc2",
"discovery": "UNKNOWN"
},
"title": "odhcpd DHCPv6 IA dangling first pointer use-after-free"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53918",
"datePublished": "2026-10-23T13:21:00.665Z",
"dateReserved": "2026-06-11T15:46:12.315Z",
"dateUpdated": "2026-10-23T13:21:00.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53922 (GCVE-0-2026-53922)
Vulnerability from nvd – Published: 2026-10-12 21:31 – Updated: 2026-10-13 13:59
VLAI
EPSS
VEX
Title
odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/c6792bac… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d08dbcc5… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d168c27f… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d329a154… | x_refsource_MISC |
| https://github.com/openwrt/openwrt/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53922",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:59:05.921605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:59:31.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c c6792bac3905d4bf726d914e9994f6d4b98c5b57"
}
]
},
{
"product": "openwrt",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:31:24.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328"
},
{
"name": "https://github.com/openwrt/openwrt/releases/tag/v25.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/openwrt/releases/tag/v25.12.5"
}
],
"source": {
"advisory": "GHSA-7hcw-g2jh-pqv5",
"discovery": "UNKNOWN"
},
"title": "odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53922",
"datePublished": "2026-10-12T21:31:24.809Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-13T13:59:31.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55897 (GCVE-0-2026-55897)
Vulnerability from nvd – Published: 2026-09-21 19:29 – Updated: 2026-09-21 20:06
VLAI
EPSS
VEX
Title
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
Summary
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:05 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | x_refsource_CONFIRM |
| https://github.com/openwrt/luci/pull/8710 | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/2df00deb12… | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/f85102548e… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55897",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:05:24.106310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:06:41.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.2-6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:29:37.003Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6"
},
{
"name": "https://github.com/openwrt/luci/pull/8710",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/pull/8710"
},
{
"name": "https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f"
},
{
"name": "https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829"
}
],
"source": {
"advisory": "GHSA-vj96-f37g-37f6",
"discovery": "UNKNOWN"
},
"title": "luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55897",
"datePublished": "2026-09-21T19:29:37.003Z",
"dateReserved": "2026-06-17T16:59:42.760Z",
"dateUpdated": "2026-09-21T20:06:41.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55159 (GCVE-0-2026-55159)
Vulnerability from nvd – Published: 2026-09-21 19:24 – Updated: 2026-09-29 14:01
VLAI
EPSS
VEX
Title
luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
Summary
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 14:01 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | x_refsource_CONFIRM |
| https://github.com/openwrt/luci/pull/8705 | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/9ccd99b589… | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/f67461fd02… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openwrt | luci-app-adblock-fast |
Affected:
< 1.2.4-2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55159",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T14:01:03.903448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T14:01:11.023Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "luci-app-adblock-fast",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.4-2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:24:03.581Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v"
},
{
"name": "https://github.com/openwrt/luci/pull/8705",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/pull/8705"
},
{
"name": "https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e"
},
{
"name": "https://github.com/openwrt/luci/commit/f67461fd0255bf992b2b559c22ec288067f2f9da",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/f67461fd0255bf992b2b559c22ec288067f2f9da"
}
],
"source": {
"advisory": "GHSA-ggpf-xrph-wg5v",
"discovery": "UNKNOWN"
},
"title": "luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55159",
"datePublished": "2026-09-21T19:24:03.581Z",
"dateReserved": "2026-06-16T15:13:28.165Z",
"dateUpdated": "2026-09-29T14:01:11.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62381 (GCVE-0-2026-62381)
Vulnerability from nvd – Published: 2026-08-22 12:26 – Updated: 2026-08-24 19:50
VLAI
EPSS
VEX
Title
luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow
Summary
luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 19:50 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-lib-px5… | third-party-advisory |
Impacted products
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62381",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T19:50:25.578742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T19:50:50.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/openwrt/luci",
"defaultStatus": "unaffected",
"packageName": "luci-lib-px5g",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThanOrEqual": "42d72f79cd8f057f241595abc761b39dab2d9f07",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cla7aye15I4nd"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T12:26:44.558Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jgc3-4q3p-g6xh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh"
},
{
"name": "VulnCheck Advisory: luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-lib-px5g-2040-bit-certificate-signing-heap-buffer-overflow"
}
],
"title": "luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-62381",
"datePublished": "2026-08-22T12:26:44.558Z",
"dateReserved": "2026-07-13T22:40:54.412Z",
"dateUpdated": "2026-08-24T19:50:50.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72842 (GCVE-0-2026-72842)
Vulnerability from nvd – Published: 2026-08-13 21:54 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
Summary
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:24 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:24:07.375035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:24:47.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"luci-app-lxc"
],
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThanOrEqual": "24.10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "25.12.5",
"status": "affected",
"version": "25.12.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "faller-dql"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:24.610Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jf59-v86x-fwf2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jf59-v86x-fwf2"
},
{
"name": "VulnCheck Advisory: OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-app-lxc-acl-inconsistency-authentication-bypass"
}
],
"title": "OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72842",
"datePublished": "2026-08-13T21:54:41.307Z",
"dateReserved": "2026-08-10T15:14:51.467Z",
"dateUpdated": "2026-09-30T17:20:24.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72841 (GCVE-0-2026-72841)
Vulnerability from nvd – Published: 2026-08-13 21:54 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
luci-app-openvpn Path Traversal RCE via instance_name2
Summary
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 01:41 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-app-ope… | third-party-advisory |
Impacted products
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72841",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T01:41:58.201865Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T01:42:17.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"luci-app-openvpn"
],
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "24.10.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.12.4",
"status": "affected",
"version": "25.12.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "faller-dql"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:23.925Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jjcx-c284-2qv8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8"
},
{
"name": "VulnCheck Advisory: luci-app-openvpn Path Traversal RCE via instance_name2",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-app-openvpn-path-traversal-rce-via-instance-name2"
}
],
"title": "luci-app-openvpn Path Traversal RCE via instance_name2",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72841",
"datePublished": "2026-08-13T21:54:40.631Z",
"dateReserved": "2026-08-10T15:13:41.486Z",
"dateUpdated": "2026-09-30T17:20:23.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72840 (GCVE-0-2026-72840)
Vulnerability from nvd – Published: 2026-08-13 21:54 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
Summary
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 19:03 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72840",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T19:03:28.552422Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T19:03:37.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"luci-mod-system"
],
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThanOrEqual": "24.10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "25.12.5",
"status": "affected",
"version": "25.12.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lujiefsi"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:23.228Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v5f9-62c7-cw29)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29"
},
{
"name": "VulnCheck Advisory: OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-luci-mod-system-mounts-acl-root-rce-via-crontab-write"
}
],
"title": "OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72840",
"datePublished": "2026-08-13T21:54:39.948Z",
"dateReserved": "2026-08-10T15:13:41.486Z",
"dateUpdated": "2026-09-30T17:20:23.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69096 (GCVE-0-2026-69096)
Vulnerability from nvd – Published: 2026-08-03 13:20 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
Summary
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://github.com/openwrt/luci/commit/f4d0a44950… | patch |
| https://github.com/openwrt/luci/commit/44618b5b53… | patch |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:57:00.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "26.162.29621~507ab5e",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:26.162.29621\\~507ab5e:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZwCrazyThursday"
}
],
"datePublic": "2026-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package\u0027s read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:14.568Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cq4h-h8jr-3xqv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-cq4h-h8jr-3xqv"
},
{
"name": "Affected master snapshot commit (still vulnerable per advisory)",
"tags": [
"patch"
],
"url": "https://github.com/openwrt/luci/commit/f4d0a44950e42bcbb8eacf715a3493b276a4f3ac"
},
{
"name": "Affected openwrt-25.12 snapshot commit (still vulnerable per advisory)",
"tags": [
"patch"
],
"url": "https://github.com/openwrt/luci/commit/44618b5b53d9bdad5cd489e82e29688b4d0862c1"
},
{
"name": "VulnCheck Advisory: OpenWrt luci-app-dockerman Read ACL Remote Code Execution",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-app-dockerman-read-acl-remote-code-execution"
}
],
"title": "OpenWrt luci-app-dockerman Read ACL Remote Code Execution",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-69096",
"datePublished": "2026-08-03T13:20:48.536Z",
"dateReserved": "2026-08-03T10:44:14.336Z",
"dateUpdated": "2026-08-14T16:51:14.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69095 (GCVE-0-2026-69095)
Vulnerability from nvd – Published: 2026-08-03 13:20 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
Summary
OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:08 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69095",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:08:43.642728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:09:30.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "5890760a454dad2cb00389dba2cdc5e779e0ffdd",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"status": "unaffected",
"version": "5890760a454dad2cb00389dba2cdc5e779e0ffdd",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nebusecurity"
}
],
"datePublic": "2026-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:13.952Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8qcq-jgrj-gvmj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj"
},
{
"name": "VulnCheck Advisory: OpenWrt luci-app-bmx7 Path Traversal via bmx7-info",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-app-bmx7-path-traversal-via-bmx7-info"
}
],
"title": "OpenWrt luci-app-bmx7 Path Traversal via bmx7-info",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-69095",
"datePublished": "2026-08-03T13:20:47.836Z",
"dateReserved": "2026-08-03T10:44:14.335Z",
"dateUpdated": "2026-08-14T16:51:13.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68583 (GCVE-0-2026-68583)
Vulnerability from nvd – Published: 2026-08-02 12:15 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
Summary
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 15:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-app-adb… | third-party-advisory |
Impacted products
Date Public
2026-07-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68583",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T15:40:59.085453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:41:14.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "1.2.4-4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.2.4-4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mossdef:luci-app-adblock-fast:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.4-4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lujiefsi"
}
],
"datePublic": "2026-07-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator\u0027s browser under the LuCI origin."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:06.295Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q335-4c83-c88h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h"
},
{
"name": "VulnCheck Advisory: luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-app-adblock-fast-before-4-stored-xss-via-file-url-name"
}
],
"title": "luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-68583",
"datePublished": "2026-08-02T12:15:29.275Z",
"dateReserved": "2026-07-31T11:56:29.760Z",
"dateUpdated": "2026-08-14T16:51:06.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67352 (GCVE-0-2026-67352)
Vulnerability from nvd – Published: 2026-08-01 12:22 – Updated: 2026-08-03 15:38
VLAI
EPSS
VEX
Title
luci-app-https-dns-proxy Stored XSS via resolver_url
Summary
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:46 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-app-htt… | third-party-advisory |
Date Public
2026-07-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:46:56.455334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:38:30.174Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lujiefsi"
}
],
"datePublic": "2026-07-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator\u0027s browser origin."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T12:22:16.437Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-c6vf-395q-4jv6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6"
},
{
"name": "VulnCheck Advisory: luci-app-https-dns-proxy Stored XSS via resolver_url",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-stored-xss-via-resolver-url"
}
],
"title": "luci-app-https-dns-proxy Stored XSS via resolver_url",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67352",
"datePublished": "2026-08-01T12:22:16.437Z",
"dateReserved": "2026-07-29T13:36:36.277Z",
"dateUpdated": "2026-08-03T15:38:30.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55606 (GCVE-0-2026-55606)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:21 – Updated: 2026-10-23 13:21
VLAI
EPSS
VEX
Title
odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
Severity
6.5 (Medium)
CWE
- CWE-126 - Buffer Over-read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/pull/401 | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/6907f28f… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/ed38cffa… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c= 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd\u0027s DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer \u2014 a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126: Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:21:21.038Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-x8x4-7gvf-gp45"
},
{
"name": "https://github.com/openwrt/odhcpd/pull/401",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/pull/401"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/6907f28f9ddeef9f69f5ee10bbc9ba8adc0ef57f"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/ed38cffa927d5fd450d20bfd3f7fb8d8e8fff301"
}
],
"source": {
"advisory": "GHSA-x8x4-7gvf-gp45",
"discovery": "UNKNOWN"
},
"title": "odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55606",
"datePublished": "2026-10-23T13:21:21.038Z",
"dateReserved": "2026-06-16T23:31:22.445Z",
"dateUpdated": "2026-10-23T13:21:21.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53918 (GCVE-0-2026-53918)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:21 – Updated: 2026-10-23 13:21
VLAI
EPSS
VEX
Title
odhcpd DHCPv6 IA dangling first pointer use-after-free
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first->key`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12.
Severity
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/26b12200… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/5b283832… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd\u0027s DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A DHCPv6 REQUEST from an adjacent-network client can make the first IA set `first`, then make a later same-IAID IA fail the on-link check and free that same lease, leaving `first` dangling. A following IA in the same packet allocates a new lease and copies `first-\u003ekey`, producing a 16-byte heap-use-after-free read. ASan confirms the UAF; native tracing shows the packet shape can deterministically reclaim the freed lease as the destination allocation, producing a zeroed Reconfigure key copy. The validated impact is unauthenticated adjacent-network denial of service and DHCPv6 Reconfigure/ForceRenew key confusion. Arbitrary PC control is not proven for this UAF alone. This issue has been patched in version 25.12."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416: Use After Free",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-672",
"description": "CWE-672: Operation on a Resource after Expiration or Release",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-825",
"description": "CWE-825: Expired Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:21:00.665Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-44ff-jcwh-wgc2"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/26b122007030ebf192376aff8f98d428b25e2a93"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/5b283832c0a77aed20f1cc384ffc40bc768b06e9"
}
],
"source": {
"advisory": "GHSA-44ff-jcwh-wgc2",
"discovery": "UNKNOWN"
},
"title": "odhcpd DHCPv6 IA dangling first pointer use-after-free"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53918",
"datePublished": "2026-10-23T13:21:00.665Z",
"dateReserved": "2026-06-11T15:46:12.315Z",
"dateUpdated": "2026-10-23T13:21:00.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53920 (GCVE-0-2026-53920)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:20 – Updated: 2026-10-23 20:58
VLAI
EPSS
VEX
Title
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 17:33 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/719fc3ab… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/f2275efc… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53920",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T17:33:12.791918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T20:58:10.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003e= 17.01.0, \u003c 25.12.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd\u0027s DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia-\u003eiaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd\u0027s 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "CWE-126: Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:20:48.045Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-p769-5v73-pc4f"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/719fc3abc0d7e7059871f9f572fb05ada86b8ff2"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/f2275efc72a87a95f971f159babcbadc5d241d42"
}
],
"source": {
"advisory": "GHSA-p769-5v73-pc4f",
"discovery": "UNKNOWN"
},
"title": "odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53920",
"datePublished": "2026-10-23T13:20:48.045Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-23T20:58:10.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53921 (GCVE-0-2026-53921)
Vulnerability from cvelistv5 – Published: 2026-10-23 13:20 – Updated: 2026-10-23 13:20
VLAI
EPSS
VEX
Title
odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
Severity
9.8 (Critical)
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/0320032a… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/03dacc23… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/2a42d34c… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/6634b7a3… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d168c27f… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d329a154… | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd\u0027s DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T13:20:30.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/0320032ae313452f3c8cb8725c621dd06c36dc03"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/03dacc23356b5789842b9d1bba0200fd005e35f3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/03dacc23356b5789842b9d1bba0200fd005e35f3"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/2a42d34c3615e2449ca273f673eee7c429d819a9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/2a42d34c3615e2449ca273f673eee7c429d819a9"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/6634b7a3c79c41a27687925c98c35c8aea2f2b5a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/6634b7a3c79c41a27687925c98c35c8aea2f2b5a"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328"
}
],
"source": {
"advisory": "GHSA-7fwx-hhrg-3496",
"discovery": "UNKNOWN"
},
"title": "odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53921",
"datePublished": "2026-10-23T13:20:30.249Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-23T13:20:30.249Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-53922 (GCVE-0-2026-53922)
Vulnerability from cvelistv5 – Published: 2026-10-12 21:31 – Updated: 2026-10-13 13:59
VLAI
EPSS
VEX
Title
odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
Summary
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution.
Severity
6.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 13:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/odhcpd/security/adviso… | x_refsource_CONFIRM |
| https://github.com/openwrt/odhcpd/commit/c6792bac… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d08dbcc5… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d168c27f… | x_refsource_MISC |
| https://github.com/openwrt/odhcpd/commit/d329a154… | x_refsource_MISC |
| https://github.com/openwrt/openwrt/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-53922",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T13:59:05.921605Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T13:59:31.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "odhcpd",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c c6792bac3905d4bf726d914e9994f6d4b98c5b57"
}
]
},
{
"product": "openwrt",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 25.12.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191: Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T21:31:24.809Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/odhcpd/security/advisories/GHSA-7hcw-g2jh-pqv5"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/c6792bac3905d4bf726d914e9994f6d4b98c5b57"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d08dbcc527cb8f296cd132c1e5bca696e77095b8"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d168c27fb6a55a07ac4c888e09ff2f41e263d7b7"
},
{
"name": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/odhcpd/commit/d329a15413387027453644cd363dca06ade28328"
},
{
"name": "https://github.com/openwrt/openwrt/releases/tag/v25.12.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/openwrt/releases/tag/v25.12.5"
}
],
"source": {
"advisory": "GHSA-7hcw-g2jh-pqv5",
"discovery": "UNKNOWN"
},
"title": "odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-53922",
"datePublished": "2026-10-12T21:31:24.809Z",
"dateReserved": "2026-06-11T15:46:12.316Z",
"dateUpdated": "2026-10-13T13:59:31.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55897 (GCVE-0-2026-55897)
Vulnerability from cvelistv5 – Published: 2026-09-21 19:29 – Updated: 2026-09-21 20:06
VLAI
EPSS
VEX
Title
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
Summary
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:05 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | x_refsource_CONFIRM |
| https://github.com/openwrt/luci/pull/8710 | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/2df00deb12… | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/f85102548e… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55897",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:05:24.106310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:06:41.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 1.1.2-6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:29:37.003Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6"
},
{
"name": "https://github.com/openwrt/luci/pull/8710",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/pull/8710"
},
{
"name": "https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f"
},
{
"name": "https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829"
}
],
"source": {
"advisory": "GHSA-vj96-f37g-37f6",
"discovery": "UNKNOWN"
},
"title": "luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55897",
"datePublished": "2026-09-21T19:29:37.003Z",
"dateReserved": "2026-06-17T16:59:42.760Z",
"dateUpdated": "2026-09-21T20:06:41.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55159 (GCVE-0-2026-55159)
Vulnerability from cvelistv5 – Published: 2026-09-21 19:24 – Updated: 2026-09-29 14:01
VLAI
EPSS
VEX
Title
luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
Summary
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 14:01 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | x_refsource_CONFIRM |
| https://github.com/openwrt/luci/pull/8705 | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/9ccd99b589… | x_refsource_MISC |
| https://github.com/openwrt/luci/commit/f67461fd02… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| openwrt | luci-app-adblock-fast |
Affected:
< 1.2.4-2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55159",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T14:01:03.903448Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T14:01:11.023Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "luci-app-adblock-fast",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.4-2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:24:03.581Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v"
},
{
"name": "https://github.com/openwrt/luci/pull/8705",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/pull/8705"
},
{
"name": "https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e"
},
{
"name": "https://github.com/openwrt/luci/commit/f67461fd0255bf992b2b559c22ec288067f2f9da",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openwrt/luci/commit/f67461fd0255bf992b2b559c22ec288067f2f9da"
}
],
"source": {
"advisory": "GHSA-ggpf-xrph-wg5v",
"discovery": "UNKNOWN"
},
"title": "luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55159",
"datePublished": "2026-09-21T19:24:03.581Z",
"dateReserved": "2026-06-16T15:13:28.165Z",
"dateUpdated": "2026-09-29T14:01:11.023Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62381 (GCVE-0-2026-62381)
Vulnerability from cvelistv5 – Published: 2026-08-22 12:26 – Updated: 2026-08-24 19:50
VLAI
EPSS
VEX
Title
luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow
Summary
luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 19:50 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-lib-px5… | third-party-advisory |
Impacted products
Date Public
2026-08-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62381",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T19:50:25.578742Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T19:50:50.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com/openwrt/luci",
"defaultStatus": "unaffected",
"packageName": "luci-lib-px5g",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThanOrEqual": "42d72f79cd8f057f241595abc761b39dab2d9f07",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:-:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cla7aye15I4nd"
}
],
"datePublic": "2026-08-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T12:26:44.558Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jgc3-4q3p-g6xh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jgc3-4q3p-g6xh"
},
{
"name": "VulnCheck Advisory: luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-lib-px5g-2040-bit-certificate-signing-heap-buffer-overflow"
}
],
"title": "luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-62381",
"datePublished": "2026-08-22T12:26:44.558Z",
"dateReserved": "2026-07-13T22:40:54.412Z",
"dateUpdated": "2026-08-24T19:50:50.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72842 (GCVE-0-2026-72842)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:54 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
Summary
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 16:24 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72842",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T16:24:07.375035Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:24:47.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"luci-app-lxc"
],
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThanOrEqual": "24.10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "25.12.5",
"status": "affected",
"version": "25.12.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "faller-dql"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` parameter to escape container directories and control host-side scripts executed through `lxc.hook.start-host`, achieving root code execution on the OpenWrt host."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:24.610Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jf59-v86x-fwf2)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jf59-v86x-fwf2"
},
{
"name": "VulnCheck Advisory: OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-app-lxc-acl-inconsistency-authentication-bypass"
}
],
"title": "OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72842",
"datePublished": "2026-08-13T21:54:41.307Z",
"dateReserved": "2026-08-10T15:14:51.467Z",
"dateUpdated": "2026-09-30T17:20:24.610Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72841 (GCVE-0-2026-72841)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:54 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
luci-app-openvpn Path Traversal RCE via instance_name2
Summary
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.
Severity
9.9 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 01:41 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-app-ope… | third-party-advisory |
Impacted products
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72841",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T01:41:58.201865Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T01:42:17.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"luci-app-openvpn"
],
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "24.10.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "25.12.4",
"status": "affected",
"version": "25.12.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "faller-dql"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:23.925Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jjcx-c284-2qv8)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-jjcx-c284-2qv8"
},
{
"name": "VulnCheck Advisory: luci-app-openvpn Path Traversal RCE via instance_name2",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-app-openvpn-path-traversal-rce-via-instance-name2"
}
],
"title": "luci-app-openvpn Path Traversal RCE via instance_name2",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72841",
"datePublished": "2026-08-13T21:54:40.631Z",
"dateReserved": "2026-08-10T15:13:41.486Z",
"dateUpdated": "2026-09-30T17:20:23.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72840 (GCVE-0-2026-72840)
Vulnerability from cvelistv5 – Published: 2026-08-13 21:54 – Updated: 2026-09-30 17:20
VLAI
EPSS
VEX
Title
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
Summary
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 19:03 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72840",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T19:03:28.552422Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T19:03:37.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"luci-mod-system"
],
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThanOrEqual": "24.10.8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "25.12.5",
"status": "affected",
"version": "25.12.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lujiefsi"
}
],
"datePublic": "2026-07-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-30T17:20:23.228Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-v5f9-62c7-cw29)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29"
},
{
"name": "VulnCheck Advisory: OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-luci-mod-system-mounts-acl-root-rce-via-crontab-write"
}
],
"title": "OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-72840",
"datePublished": "2026-08-13T21:54:39.948Z",
"dateReserved": "2026-08-10T15:13:41.486Z",
"dateUpdated": "2026-09-30T17:20:23.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69096 (GCVE-0-2026-69096)
Vulnerability from cvelistv5 – Published: 2026-08-03 13:20 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
Summary
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 00:00 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://github.com/openwrt/luci/commit/f4d0a44950… | patch |
| https://github.com/openwrt/luci/commit/44618b5b53… | patch |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69096",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:57:00.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"status": "affected",
"version": "26.162.29621~507ab5e",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:26.162.29621\\~507ab5e:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ZwCrazyThursday"
}
],
"datePublic": "2026-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package\u0027s read ACL grants broad ubus access to docker.* / docker.container.*, which exposes the docker.container.ttyd_start method even though it performs mutating operations. The run_ttyd handler builds a shell command from the request-controlled id, cmd, and uid fields and passes it to system() without quoting or argv-style execution in the rpcd root context. An authenticated attacker holding only the luci-app-dockerman read ACL can inject shell metacharacters (e.g., in id) to execute arbitrary commands as root via an HTTP POST to /ubus. openwrt-24.10 and openwrt-23.05 do not contain this backend and are not affected; no patched version was known as of the advisory."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:14.568Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cq4h-h8jr-3xqv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-cq4h-h8jr-3xqv"
},
{
"name": "Affected master snapshot commit (still vulnerable per advisory)",
"tags": [
"patch"
],
"url": "https://github.com/openwrt/luci/commit/f4d0a44950e42bcbb8eacf715a3493b276a4f3ac"
},
{
"name": "Affected openwrt-25.12 snapshot commit (still vulnerable per advisory)",
"tags": [
"patch"
],
"url": "https://github.com/openwrt/luci/commit/44618b5b53d9bdad5cd489e82e29688b4d0862c1"
},
{
"name": "VulnCheck Advisory: OpenWrt luci-app-dockerman Read ACL Remote Code Execution",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-app-dockerman-read-acl-remote-code-execution"
}
],
"title": "OpenWrt luci-app-dockerman Read ACL Remote Code Execution",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-69096",
"datePublished": "2026-08-03T13:20:48.536Z",
"dateReserved": "2026-08-03T10:44:14.336Z",
"dateUpdated": "2026-08-14T16:51:14.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-69095 (GCVE-0-2026-69095)
Vulnerability from cvelistv5 – Published: 2026-08-03 13:20 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
Summary
OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:08 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/openwrt-luci… | third-party-advisory |
Impacted products
Date Public
2026-07-20 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-69095",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:08:43.642728Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T14:09:30.544Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "5890760a454dad2cb00389dba2cdc5e779e0ffdd",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"status": "unaffected",
"version": "5890760a454dad2cb00389dba2cdc5e779e0ffdd",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "nebusecurity"
}
],
"datePublic": "2026-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:13.952Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8qcq-jgrj-gvmj)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj"
},
{
"name": "VulnCheck Advisory: OpenWrt luci-app-bmx7 Path Traversal via bmx7-info",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openwrt-luci-app-bmx7-path-traversal-via-bmx7-info"
}
],
"title": "OpenWrt luci-app-bmx7 Path Traversal via bmx7-info",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-69095",
"datePublished": "2026-08-03T13:20:47.836Z",
"dateReserved": "2026-08-03T10:44:14.335Z",
"dateUpdated": "2026-08-14T16:51:13.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-68583 (GCVE-0-2026-68583)
Vulnerability from cvelistv5 – Published: 2026-08-02 12:15 – Updated: 2026-08-14 16:51
VLAI
EPSS
VEX
Title
luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
Summary
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 15:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-app-adb… | third-party-advisory |
Impacted products
Date Public
2026-07-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-68583",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T15:40:59.085453Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:41:14.987Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "1.2.4-4",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.2.4-4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mossdef:luci-app-adblock-fast:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.4-4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lujiefsi"
}
],
"datePublic": "2026-07-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator\u0027s browser under the LuCI origin."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T16:51:06.295Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q335-4c83-c88h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h"
},
{
"name": "VulnCheck Advisory: luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-app-adblock-fast-before-4-stored-xss-via-file-url-name"
}
],
"title": "luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-68583",
"datePublished": "2026-08-02T12:15:29.275Z",
"dateReserved": "2026-07-31T11:56:29.760Z",
"dateUpdated": "2026-08-14T16:51:06.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67352 (GCVE-0-2026-67352)
Vulnerability from cvelistv5 – Published: 2026-08-01 12:22 – Updated: 2026-08-03 15:38
VLAI
EPSS
VEX
Title
luci-app-https-dns-proxy Stored XSS via resolver_url
Summary
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:46 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openwrt/luci/security/advisori… | vendor-advisory |
| https://www.vulncheck.com/advisories/luci-app-htt… | third-party-advisory |
Date Public
2026-07-17 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:46:56.455334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:38:30.174Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "luci",
"vendor": "openwrt",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lujiefsi"
}
],
"datePublic": "2026-07-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator\u0027s browser origin."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-01T12:22:16.437Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-c6vf-395q-4jv6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6"
},
{
"name": "VulnCheck Advisory: luci-app-https-dns-proxy Stored XSS via resolver_url",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-stored-xss-via-resolver-url"
}
],
"title": "luci-app-https-dns-proxy Stored XSS via resolver_url",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-67352",
"datePublished": "2026-08-01T12:22:16.437Z",
"dateReserved": "2026-07-29T13:36:36.277Z",
"dateUpdated": "2026-08-03T15:38:30.174Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}