CVE-2026-69095 OpenWrt luci-app-bmx7 Path Traversal via bmx7-info

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query...

PT-2026-67417

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query...

CVE-2026-69095: Improper Limitation of a Pathname to a Restricted Directory

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query...

PT-2026-67418

Name of the Vulnerable Software and Affected Versions luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode docker rpc.uc RPC backend Description An OS command injection issue exists where the read ACL grants broad ubus access to docker. and docker.container., exposing t...

MIPS LE reverse TCP shell (raw)

MIPS little-endian 32-bit connect-back stager: socket, connect, dup2 x3, execve //bin/sh. Common on OpenWrt/MIPSEL routers. Output is raw bytes not a command string. !/usr/bin/env python3 -- coding: utf-8 -- Linux/MIPS LE reverse TCP + dup2 + execve"//bin/sh" — based on public shellcode by rigan...

BusyBox Embedded HTTP Polling C2

POSIX/BusyBox ash HTTP polling implant for OpenWrt and embedded Linux. Pairs with listeners/multi/reversehttppolling base64 command protocol. from kittysploit import from lib.c2.embeddedhttpagent import buildembeddedhttpagentscript from lib.c2.embeddedsession import EmbeddedC2Mixin import uuid...

Deploy Embedded HTTP C2

Generate and optionally execute a BusyBox/ash HTTP polling agent on an OpenWrt/embedded shell. Pairs with listeners/multi/reversehttppolling. !/usr/bin/env python3 -- coding: utf-8 -- """Deploy BusyBox embedded HTTP polling C2 from a live shell session.""" from kittysploit import from...

OpenWrt / BusyBox Dump NVRAM UCI

Dump router configuration via nvram show, uci export, and common config paths /etc/config, /tmp/nvram. !/usr/bin/env python3 -- coding: utf-8 -- """Dump OpenWrt nvram / UCI configuration from an embedded shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMixin import...

OpenWrt / BusyBox Network Recon

Enumerate interfaces, routes, ARP/neighbors, DNS, and listening sockets on an embedded Linux shell for LAN/WAN pivot planning. !/usr/bin/env python3 -- coding: utf-8 -- """Network / pivot recon for OpenWrt / BusyBox shells.""" from kittysploit import from lib.post.linux.session import...

OpenWrt / BusyBox Dump Dropbear Keys

Locate and dump Dropbear host keys, authorizedkeys, and related SSH material on embedded Linux / OpenWrt targets. !/usr/bin/env python3 -- coding: utf-8 -- """Collect Dropbear / SSH keys from an OpenWrt / BusyBox shell.""" from kittysploit import from lib.post.linux.session import LinuxSessionMix...

OpenWrt / BusyBox Firmware Info

Collect firmware/board identity from an embedded Linux shell: openwrtrelease, board name, uname, and common version files. !/usr/bin/env python3 -- coding: utf-8 -- """Gather OpenWrt / embedded firmware identity from a BusyBox-style shell.""" from kittysploit import from lib.post.linux.session...

OpenWrt DHCPv6 DoS Execution Arbitrary Code

The vulnerability of the DHCPv6 server in the embedded operating system OpenWrt is related to buffer overflow in the stack. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt's GitHub advisory, lets an unauthenticated attacke...

Nodogsplash - Directory Traversal Detection

Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system. !/usr/bin/env python3 -...

openwrt v24.10.8

OpenWrt Project is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows yo...

UBUNTU-CVE-2026-64248

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

EUVD-2026-48657

In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: report dying CPU to RCU in stopthiscpu smpsendstop parks all secondary CPUs in stopthiscpu. The function marks the CPU offline for the scheduler via setcpuonlinefalse but never informs RCU, so RCU keeps expecting a...

CVE-2026-62947

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6 and statefileswritestate4 without escaping, allowing newline injection of forged lease lin...

CVE-2026-62947 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...