PT-2026-67417

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query...

PT-2026-67418

Name of the Vulnerable Software and Affected Versions luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend Description An OS command injection issue exists where the read ACL grants broad ubus access to docker. and docker.container., exposing t...

OpenWrt / BusyBox Dump Dropbear Keys

Locate and dump Dropbear host keys, authorizedkeys, and related SSH material on embedded Linux / OpenWrt targets. !/usr/bin/env python3 -- coding: utf-8 -- """Collect Dropbear / SSH keys from an OpenWrt / BusyBox shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMix...

OpenWrt / BusyBox Dump NVRAM UCI

Dump router configuration via nvram show, uci export, and common config paths /etc/config, /tmp/nvram. !/usr/bin/env python3 -- coding: utf-8 -- """Dump OpenWrt nvram / UCI configuration from an embedded shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMixin import...

Deploy Embedded HTTP C2

Generate and optionally execute a BusyBox/ash HTTP polling agent on an OpenWrt/embedded shell. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Deploy BusyBox embedded HTTP polling C2 from a live shell session.""" from kittysploit import from...

OpenWrt / BusyBox Network Recon

Enumerate interfaces, routes, ARP/neighbors, DNS, and listening sockets on an embedded Linux shell for LAN/WAN pivot planning. !/usr/bin/env python3 -- coding: utf-8 -- """Network / pivot recon for OpenWrt / BusyBox shells.""" from kittysploit import from lib.post.linux.session import...

OpenWrt / BusyBox Firmware Info

Collect firmware/board identity from an embedded Linux shell: openwrtrelease, board name, uname, and common version files. !/usr/bin/env python3 -- coding: utf-8 -- """Gather OpenWrt / embedded firmware identity from a BusyBox-style shell.""" from kittysploit import from lib.post.linux.session...

OpenWrt DHCPv6 DoS Execution Arbitrary Code

The vulnerability of the DHCPv6 server in the embedded operating system OpenWrt is related to buffer overflow in the stack. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt's GitHub advisory, lets an unauthenticated attacke...

openwrt v24.10.8

OpenWrt Project is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows yo...

UBUNTU-CVE-2026-64248

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

EUVD-2026-48657

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

CVE-2026-62947

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6 and statefileswritestate4 without escaping, allowing newline injection of forged lease lin...

CVE-2026-62947 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62947

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62947 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

EUVD-2026-44756

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62947

CVE-2026-62947 affects OpenWrt prior to 25.12.5 through the cgi-download handler in cgi-io, where the requested path is validated against the caller’s ubus session file ACL before canonicalization. The rpcd session.c uses fnmatch() without FNM_PATHNAME, enabling traversal such as an allowed wildc...

CVE-2026-62947 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...