OpenWrt
Security vulnerabilities in OpenWrt, the open-source Linux-based firmware widely deployed in consumer routers, small-business gateways, and embedded network devices. Flaws in OpenWrt affect the underlying routing and DHCPv6/DNS infrastructure of countless home and enterprise networks.
OpenWrt LuCI Mount App ACL Misconfiguration Grants Root Cron Write
luci-mod-system-mounts ACL grants /etc/crontabs/root write access to mount-config users, enabling cron injection executed as root within one minute. CVSS 8.8 high.
OpenWrt LuCI OpenVPN App Path Traversal Enables Root RCE
luci-app-openvpn path traversal on file upload enables persistent root code execution on OpenWrt routers by writing arbitrary files to system paths. CVSS 9.9 critical.
OpenWrt LuCI Container App ACL Bypass Leads to Root RCE
luci-app-lxc ACL inconsistency lets low-privileged authenticated users exploit path traversal to achieve root code execution on the OpenWrt host. CVSS 9.9 critical.
Three Critical OpenWrt LuCI Flaws Allow Root RCE
Two CVSS 9.9 and one 8.8 vulnerabilities in OpenWrt's LuCI web interface let authenticated users execute arbitrary code as root. Update LuCI now.
OpenWrt Patches Critical DHCPv6 RCE in Default Server
OpenWrt 24.10.8 patches a critical stack overflow in odhcpd — the DHCPv6 server enabled by default — allowing unauthenticated RCE as root. Patch now.