CVE-2026-30874

A flaw was found in the procd component of OpenWrt. A highly privileged local attacker can bypass environment variable filtering in the hotplugcall function by injecting an arbitrary PATH variable. This vulnerability, caused by an incorrect string comparison, allows the attacker to control which...

CVE-2026-30874

OpenWrt procd PATH environment variable filter bypass (CVE-2026-30874). In OpenWrt versions prior to 24.10.6, hotplug_call does not exclude PATH due to a strcmp vs strncmp bug, allowing a local attacker to influence which binaries are executed by procd-invoked scripts with elevated privileges, po...

CVE-2026-30874 OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplugcall function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The...

CVE-2026-30874 OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplugcall function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The...

Вышла операционная система OpenWrt 14.07

Встроенная операционная система OpenWrt обновилась до версии 14.07. Эту ОС часто устанавливают на маршрутизаторах как замену проприетарным прошивкам. Основные компоненты OpenWrt включают в себя ядро Linux, util-linux, uClibc и BusyBox. Размер всех компонентов минимизирован, чтобы работать на...