CVE-2026-55159

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-55897

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

EUVD-2026-84101

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897 luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55897

luci-app-advanced-reboot , a LuCI web UI application for OpenWrt, contained a read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json that granted rpcd file.exec permission for the general shell interpreter /bin/sh . Prior to version 1.1.2-6 , an ...

EUVD-2026-84099

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-55159 luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-55159

CVE-2026-55159 affects luci-app-adblock-fast , a WebUI for a DNS-based ad-blocker on OpenWrt (compatible with dnsmasq, smartdns, or unbound). Prior to 1.2.4-2 , the luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return or line-feed characters in its entry argument, serializi...

CVE-2026-55159 luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-46368-OpenWrt-Exploit

OpenWrt luci-app-https-dns-proxy 認証済みコマンドインジェクション CVE-2026-46368 このリポジトリには、luci-app-https-dns-proxy における深刻なOSコマンドインジェクションの脆弱性に対する Proof of Concept PoC エクスプロイトが含まれており、root として任意のコマンド実行が可能になります。 CVE ID: CVE-2026-46368 Exploit-DB: EDB-52521 CVSS: 8.8 v3.1 / 8.7 v4.0 — 高 CWE: CWE-77...

CVE-2026-55897: Improper Neutralization of Special Elements used in an OS Command

luci-app-advanced-reboot is a LuCI web interface application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in...

CVE-2026-55159: Improper Neutralization of CRLF Sequences

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

EUVD-2026-67101

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26899

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

CVE-2026-26899

The luci-app-https-dns-proxy component in OpenWrt PR #15 (prior to 2026-01-17) is vulnerable to arbitrary command execution. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy fails to properly neutralize shell metacharacters in the name parameter, allowing authenticated users t...

CVE-2026-26899: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

PT-2026-82517

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...