CVE-2026-46368-OpenWrt-Exploit

OpenWrt luci-app-https-dns-proxy 经过身份验证的命令注入（CVE-2026-46368） 本仓库包含针对 luci-app-https-dns-proxy 中关键操作系统命令注入漏洞的概念验证（PoC）利用程序，该漏洞可导致以 root 身份执行任意命令。 CVE ID: CVE-2026-46368 Exploit-DB: EDB-52521 CVSS: 8.8（v3.1）/ 8.7（v4.0）— 高危 CWE: CWE-77（命令中对特殊元素处理不当） 漏洞详情 厂商: OpenWrt 社区包（维护者: mossdef-org / stangri） 产...

LuCI_RCE_exp

CVE-2019-12272 の EXP CVE-2019-12272 は、LuCI の任意の bash コードを実行できる脆弱性です。 詳細 https://hachp1.github.io/posts/Web%E5%AE%89%E5%85%A8/20190710-lucirce.html 使用方法 python .\cve-2019-12272bandwidthstatus.py -a 192.168.153.4 -u root -p root -c ls python .\cve-2019-12272wirelessstatus.py -a 192.168.153.4 -u roo...

CVE-2026-22226

CVE-2026-22226 Prueba de concepto para CVE-2026-22226 Inyección de comandos del sistema operativo autenticada en el lado LAN en el cliente VPN de los routers Wi-Fi TP-Link Archer Resumen de la vulnerabilidad El controlador del cliente VPN almacena la descripción de la entrada controlada por el...

CVE-2025-57389

CVE-2025-57389 - OpenWRT 18.06.2 中的反射型 XSS 描述 在已停止维护（EOL）的 Luci OpenWRT v18.06.2 的 /cgi-bin/luci/admin/system/packages 端点上发现了一个反射型跨站脚本（XSS）漏洞。 概念验证 1. 在将流量代理到 Burp 的同时，导航至 http://192.168.56.2/cgi-bin/luci/admin/system/packages， 2. 在 Filter （过滤器）中输入任意软件包名称并提交， 3. 将发送到该端点的 POST 请求转发到 Repeater， 4. 在...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26899

CVE-2026-26899 affects the luci-app-https-dns-proxy package on OpenWrt (versions prior to 2026-01-17). The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy fails to sanitize the name parameter, allowing authenticated users to execute arbitrary shell commands via shell metacharacte...

PT-2026-82517

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-62381

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62381 luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

EUVD-2026-64273

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62381

luci-lib-px5g (LuCI) in OpenWrt contains a heap-based buffer overflow in the ASN.1 encoding routine asn1_add_obj (x509write.c) triggered when signing a certificate with a 2040-bit RSA key . The BIT STRING allocation is sized for a 255-byte signature's DER length encoding, but prepending the unuse...

CVE-2026-19771

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

CVE-2026-19771 Baicells EG3661M LuCI Web luci os command injection

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

EUVD-2026-58564

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

CVE-2026-19771

A vulnerability was identified in Baicells EG3661M BaiCEBQ62.0.5.3NA. This impacts an unknown function of the file /cgi-bin/luci of the component LuCI Web Interface. Such manipulation of the argument MaxHops/Timeout/Size leads to os command injection. The attack may be launched remotely. The...

CVE-2026-19771

CVE-2026-19771 affects Baicells EG3661M with LuCI Web Interface (file /cgi-bin/luci). The vulnerability arises from manipulating the arguments MaxHops/Timeout/Size, enabling OS command injection. AttackVector is NETWORK with LOW complexity and none user interaction required; authenticated context...

EUVD-2026-58499

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...

EUVD-2026-58549

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...