CVE-2026-55897: falha de alta gravidade em openwrt luci
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.7%
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
openwrt · luciCVEs relacionadas — openwrt luci
No mesmo produto, das mais perigosas para as menos.
CVE-2026-69096HIGHOpenWrt luci-app-dockerman Read ACL Remote Code ExecutionEPSS 3.3%CVE-2026-61876CRITICALLuCI DHCPv6 Lease Hostname Stored Cross-Site ScriptingEPSS 1.6%CVE-2026-69095HIGHOpenWrt luci-app-bmx7 Path Traversal via bmx7-infoEPSS 0.9%CVE-2026-59260HIGHOpenWrt luci-app-samba4 read ACL remote code execution via smbdEPSS 0.9%CVE-2026-72842CRITICALOpenWrt luci-app-lxc ACL Inconsistency Authentication BypassEPSS 0.6%CVE-2026-72841CRITICALluci-app-openvpn Path Traversal RCE via instance_name2EPSS 0.6%