Loading story…
OpenWrt disclosed a high-severity command injection vulnerability in luci-proto-openvpn through version 0.11.1 that allows an authenticated LuCI user to execute arbitrary commands as root. The flaw affects the generateKey ubus method in the LuCI OpenVPN rpcd backend, where the caller-controlled cl_meta parameter is inserted into a shell command without proper quoting or escaping. Because rpcd runs with root privileges, an attacker with access to the OpenVPN protocol configuration can remotely achieve full device compromise, including reading or modifying files, changing firewall and network settings, and installing persistence.
Advisory details said the official LuCI front end was only accidentally safe because it base64-encoded cl_meta, while the backend still accepted raw values through direct ubus or LuCI RPC calls without server-side validation. A proof of concept reportedly executed id as root and created /tmp/INJECTED_PROOF on an OpenWrt 23.05.5 root filesystem. OpenWrt fixed the issue in commit e4ff45e, which wraps cl_meta with shellquote(), and users were urged to update luci-proto-openvpn, apply the patch, restrict configuration access, and monitor for suspicious command execution.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-58000 was published for a high-severity command injection vulnerability affecting luci-proto-openvpn through version 0.11.1. The issue allows an authenticated LuCI user with OpenVPN protocol configuration access to execute arbitrary commands as root, and references commit e4ff45e as the fix.
A GitHub security advisory disclosed that the luci.openvpn generateKey ubus method allowed authenticated users with OpenVPN configuration access to inject commands as root through the unescaped cl_meta parameter. The advisory also noted a proof of concept that executed id as root and created /tmp/INJECTED_PROOF on an OpenWrt 23.05.5 rootfs.
OpenWrt committed a fix for a shell code injection issue in luci-proto-openvpn by wrapping the generateKey method's cl_meta argument with shellquote(). The commit was made by Jo-Philipp Wich and addresses command execution risk in the OpenVPN RPC backend.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **`CVE-2026-69096`** allows authenticated attackers to achieve remote code execution as root in OpenWrt deployments using **LuCI master** or **OpenWrt 25.12 snapshots** that include the `ucode` `docker_rpc.uc` backend for `luci-app-dockerman`. The issue combines overly broad read ACL permissions with unsafe command construction in the `docker.container.ttyd_start` path, where attacker-controlled `id`, `cmd`, and `uid` fields are passed to `system()` without proper quoting or argv-style handling, enabling OS command injection via an HTTP `POST` request to `/ubus`. The vulnerable code runs in the `rpcd` root context, meaning a user with only the **`luci-app-dockerman` read ACL** can execute arbitrary shell commands with full privileges by injecting shell metacharacters. The flaw is classified as **`CWE-78`** and carries a **CVSS v3.1** score vector of **`AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`**. Advisories state that **OpenWrt 24.10** and **23.05** are not affected because they do not include the vulnerable backend, and no patched version was available at the time of disclosure.
Aug 4, 2026
STAR Labs disclosed two authenticated command injection vulnerabilities in the Prolink `PRC2402M` router that allow arbitrary command execution as `root` on firmware version `20190909`. Tracked as `CVE-2021-35404` and `CVE-2021-35406`, the flaws affect the router's `applogin.cgi` and `login.cgi` handlers, where the `sys_login1` function passes user-controlled input to the system shell without proper validation after a password hash check. In one case, the vulnerable path is triggered with `api=app`; in both cases, the `ipaddr` parameter is central to exploitation, and `lang` is also injectable in the `applogin.cgi` flow. The disclosures say an authenticated attacker can send crafted POST requests to `/cgi-bin/applogin.cgi` or `/cgi-bin/login.cgi` and execute arbitrary commands with full device privileges. STAR Labs reported the issues to Prolink, which initially said a patch was available, but a bypass was then identified and submitted by researcher Daniel Lim before the vendor issued a final fix. The advisories also note that the router's `lighttpd` service processes the requests and that exploit payloads must use CRLF line endings to be accepted in the demonstrated attack path.
Jun 29, 2026
STAR Labs disclosed two unauthenticated command injection flaws in the Prolink `PRC2402M` router that allow remote attackers to execute arbitrary commands as `root` via the `/cgi-bin/mesh.cgi` endpoint. The vulnerabilities, tracked as `CVE-2021-35400` and `CVE-2021-35407`, were verified on firmware version `20190909` and stem from user-controlled input in the `key` parameter being passed to `popen` without proper validation. One issue is reachable when `page=extender` triggers `get_extender_page`, while the other is exposed when `page=upgrade` invokes `get_upgrade_page`. In both cases, the vulnerable code builds shell commands using router values such as `lan_ipaddr` together with attacker-supplied input, enabling crafted HTTP `GET` requests to inject shell syntax and run commands on the device. Prolink was notified of the bugs on June 10, initially said a patch was available the same day, then received a bypass report on June 11 before issuing a final fix on June 13. The disclosures indicate that internet-exposed devices running the affected firmware could be compromised without authentication through the router's web interface.
Jun 29, 2026