Security vulnerabilities in OpenWrt, the open-source Linux-based firmware widely deployed in consumer routers, small-business gateways, and embedded network devices. Flaws in OpenWrt affect the underlying routing and DHCPv6/DNS infrastructure of countless home and enterprise networks. Combined article + CVE feed for the OpenWrt beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-15-openwrt-luci-critical-root-rce/https://0daynews.com/articles/2026-08-15-openwrt-luci-critical-root-rce/Two CVSS 9.9 and one 8.8 vulnerabilities in OpenWrt's LuCI web interface let authenticated users execute arbitrary code as root. Update LuCI now.Sat, 15 Aug 2026 06:00:00 GMTOpenWrtarticlehttps://0daynews.com/cve/cve-2026-72840/https://0daynews.com/cve/cve-2026-72840/luci-mod-system-mounts ACL grants /etc/crontabs/root write access to mount-config users, enabling cron injection executed as root within one minute. CVSS 8.8 high.Sat, 15 Aug 2026 00:00:00 GMTOpenWrthighcvehttps://0daynews.com/cve/cve-2026-72841/https://0daynews.com/cve/cve-2026-72841/luci-app-openvpn path traversal on file upload enables persistent root code execution on OpenWrt routers by writing arbitrary files to system paths. CVSS 9.9 critical.Sat, 15 Aug 2026 00:00:00 GMTOpenWrtcriticalcvehttps://0daynews.com/cve/cve-2026-72842/https://0daynews.com/cve/cve-2026-72842/luci-app-lxc ACL inconsistency lets low-privileged authenticated users exploit path traversal to achieve root code execution on the OpenWrt host. CVSS 9.9 critical.Sat, 15 Aug 2026 00:00:00 GMTOpenWrtcriticalcvehttps://0daynews.com/articles/2026-07-28-openwrt-24-10-8-dhcpv6-rce-critical/https://0daynews.com/articles/2026-07-28-openwrt-24-10-8-dhcpv6-rce-critical/OpenWrt 24.10.8 patches a critical stack overflow in odhcpd — the DHCPv6 server enabled by default — allowing unauthenticated RCE as root. Patch now.Tue, 28 Jul 2026 18:00:00 GMTOpenWrtarticle