CVE-2026-55897

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897

luci-app-advanced-reboot , a LuCI web UI application for OpenWrt, contained a read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json that granted rpcd file.exec permission for the general shell interpreter /bin/sh . Prior to version 1.1.2-6 , an ...

PT-2026-96233

Name of the Vulnerable Software and Affected Versions luci-app-advanced-reboot versions prior to 1.1.2-6 Description An issue exists where the read Access Control List ACL in the file applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd the...

CVE-2026-18900

CVE-2026-18900 affects H3C NX15 V100R017 in the Backend RPC component, specifically the file.exec function under /api/esps. The vulnerability arises from manipulation of the File argument, enabling OS command injection. The issue can be triggered remotely, and public exploits exist. The vendor ha...

CVE-2026-18900: Improper Neutralization of Special Elements used in an OS Command

A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public...

CVE-2026-59260 OpenWrt luci-app-samba4 read ACL remote code execution via smbd

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process,...