CVE-2019-18993: Improper Neutralization of Input During Web Page Generation

OpenWrt 18.06.4 allows XSS via the "New port forward" Name field to the cgi-bin/luci/admin/network/firewall/forwards URI this can occur, for example, on a TP-Link Archer C7 device...

PT-2019-15771

Name of the Vulnerable Software and Affected Versions PHICOMM K2PSG1218 version V22.5.9.163 Description The issue allows remote authenticated users to execute any command via shell metacharacters in the autoUpTime parameter of the /usr/lib/lua/luci/controller/admin/autoupgrade.lua file. This can ...

CVE-2019-19117: Improper Neutralization of Special Elements used in an OS Command

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

Security Advisory 2019-11-05-1 - LuCI stored XSS

DESCRIPTION A vulnerability has been reported in LuCI which allows injection of script code through maliciously crafted wireless network SSIDs. When joining a wireless network by clicking Network → Wireless → Join, the subsequent configuration view interprets the SSID of the network to join witho...

Security Advisory 2019-11-05-2 - LuCI CSRF vulnerability (CVE-2019-17367)

DESCRIPTION A logic flaw in LuCI's HTTP routing component led to ineffective CSRF token testing for various request endpoints, specifically ones using the arcombine dispatch action. This allows 3rd party web pages running in the same browser session as an active LuCI login session to perform...

CVE-2019-17367: Cross-Site Request Forgery (CSRF)

OpenWRT firmware version 18.06.4 is vulnerable to CSRF via wireless/radio0.network1, wireless/radio1.network1, firewall, firewall/zones, firewall/forwards, firewall/rules, network/wan, network/wan6, or network/lan under /cgi-bin/luci/admin/network/...

CVE-2019-12272

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus of the web application are affected by a command injection vulnerability...

CVE-2019-12272

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus of the web application are affected by a command injection vulnerability...

Command injection

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus of the web application are affected by a command injection vulnerability...

CVE-2019-12272

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus of the web application are affected by a command injection vulnerability...

CVE-2019-12272

CVE-2019-12272 affects OpenWrt LuCI prior to 0.10. The web application endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status are affected by a command injection vulnerability. The connected documents confirm the issue but do not provide details on exploit vect...

CVE-2019-12272

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus of the web application are affected by a command injection vulnerability...

PT-2019-12725

Name of the Vulnerable Software and Affected Versions OpenWrt LuCI versions prior to 0.11 Description A command injection issue affects the web application, specifically the "admin/status/realtime/bandwidth status" and "admin/status/realtime/wireless status" API endpoints. Recommendations For...

OpenWrt LuCI Input Validation Vulnerability

OpenWrt LuCI is a graphical configuration interface for OpenWrt. An input validation vulnerability exists in OpenWrt LuCI admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus, which could be exploited by remote attackers to submit a special request that could execute...

CVE-2019-12272: Improper Neutralization of Special Elements used in an OS Command

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidthstatus and admin/status/realtime/wirelessstatus of the web application are affected by a command injection vulnerability...

PT-2019-5518

Name of the Vulnerable Software and Affected Versions OpenWRT firmware version 18.06.4 Description The issue exists due to incorrect functionality of the web page structure protection mechanism in the LuCI web interface configuration of the OpenWRT embedded operating system. This can be exploited...

Access Restriction Bypass

The Conga project is a management system for remote workstations. It consists of luci, which is a secure web-based front end, and ricci, which is a secure daemon that dispatches incoming messages to underlying management modules. It was discovered that Plone, included as a part of luci, did not...

Information Disclosure

The Conga project is a management system for remote workstations. It consists of luci, which is a secure web-based front end, and ricci, which is a secure daemon that dispatches incoming messages to underlying management modules. It was discovered that Plone, included as a part of luci, did not...

Elevation Of Privileges By An Untrusted Search Path Vulnerability

Luci is a web-based high availability administration application. A flaw was found in the way the luci service was initialized. If a system administrator started the luci service from a directory that was writable to by a local user, that user could use this flaw to execute arbitrary code as the...

Teltonika RUT9XX Authentication Vulnerability

Teltonika RUT9XX LuCI is a LET router product from Teltonika Lithuania. A security vulnerability exists in /cgi-bin/luci in Teltonika RTU9XX R00.05.00.5 prior to version R31.04.89. An attacker could exploit this vulnerability to crack user passwords...