Loading story…
A high-severity vulnerability tracked as CVE-2026-69096 allows authenticated attackers to achieve remote code execution as root in OpenWrt deployments using LuCI master or OpenWrt 25.12 snapshots that include the ucode docker_rpc.uc backend for luci-app-dockerman. The issue combines overly broad read ACL permissions with unsafe command construction in the docker.container.ttyd_start path, where attacker-controlled id, cmd, and uid fields are passed to system() without proper quoting or argv-style handling, enabling OS command injection via an HTTP POST request to /ubus.
The vulnerable code runs in the rpcd root context, meaning a user with only the luci-app-dockerman read ACL can execute arbitrary shell commands with full privileges by injecting shell metacharacters. The flaw is classified as CWE-78 and carries a CVSS v3.1 score vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Advisories state that OpenWrt 24.10 and 23.05 are not affected because they do not include the vulnerable backend, and no patched version was available at the time of disclosure.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry states that disclosure@vulncheck.com received the new CVE-2026-69096 on August 3, 2026. The issue concerns an authenticated OS command injection flaw in OpenWrt's luci-app-dockerman component.
VulnCheck published an advisory describing an authenticated OS command injection vulnerability in OpenWrt LuCI master and openwrt-25.12 snapshots with the ucode docker_rpc.uc backend. The advisory said attackers with only the luci-app-dockerman read ACL could send an HTTP POST to /ubus and execute arbitrary commands as root, and noted no patched version was known at the time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenWrt disclosed a high-severity command injection vulnerability in `luci-proto-openvpn` through version `0.11.1` that allows an authenticated LuCI user to execute arbitrary commands as root. The flaw affects the `generateKey` `ubus` method in the LuCI OpenVPN `rpcd` backend, where the caller-controlled `cl_meta` parameter is inserted into a shell command without proper quoting or escaping. Because `rpcd` runs with root privileges, an attacker with access to the OpenVPN protocol configuration can remotely achieve full device compromise, including reading or modifying files, changing firewall and network settings, and installing persistence. Advisory details said the official LuCI front end was only accidentally safe because it base64-encoded `cl_meta`, while the backend still accepted raw values through direct `ubus` or LuCI RPC calls without server-side validation. A proof of concept reportedly executed `id` as root and created `/tmp/INJECTED_PROOF` on an OpenWrt `23.05.5` root filesystem. OpenWrt fixed the issue in commit `e4ff45e`, which wraps `cl_meta` with `shellquote()`, and users were urged to update `luci-proto-openvpn`, apply the patch, restrict configuration access, and monitor for suspicious command execution.
Jun 30, 2026
STAR Labs disclosed two authenticated command injection vulnerabilities in the Prolink `PRC2402M` router that allow arbitrary command execution as `root` on firmware version `20190909`. Tracked as `CVE-2021-35404` and `CVE-2021-35406`, the flaws affect the router's `applogin.cgi` and `login.cgi` handlers, where the `sys_login1` function passes user-controlled input to the system shell without proper validation after a password hash check. In one case, the vulnerable path is triggered with `api=app`; in both cases, the `ipaddr` parameter is central to exploitation, and `lang` is also injectable in the `applogin.cgi` flow. The disclosures say an authenticated attacker can send crafted POST requests to `/cgi-bin/applogin.cgi` or `/cgi-bin/login.cgi` and execute arbitrary commands with full device privileges. STAR Labs reported the issues to Prolink, which initially said a patch was available, but a bypass was then identified and submitted by researcher Daniel Lim before the vendor issued a final fix. The advisories also note that the router's `lighttpd` service processes the requests and that exploit payloads must use CRLF line endings to be accepted in the demonstrated attack path.
Jun 29, 2026
OpenWrt released **v25.12.5** with urgent fixes for multiple security issues in default-enabled network services, including **CVE-2026-62948**, a flaw that lets an unauthenticated DHCPv6 client inject forged lines into `/tmp/odhcpd.leases` through the FQDN hostname option. Those injected entries can later be rendered as live HTML in the **LuCI** “Active DHCPv6 Leases” page, creating a stored cross-site scripting path against administrators who view the interface. The vulnerability affects OpenWrt versions prior to **25.12.5** and carries a high-impact `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` rating. The service release also patches additional vulnerabilities across **odhcpd**, **uhttpd**, **LuCI**, **cgi-io**, and **ead**, alongside updates to the Linux kernel, **OpenSSL**, **musl libc**, and **dropbear**. OpenWrt said several of the corrected issues could enable remote code execution, request smuggling, stored XSS, privilege escalation, arbitrary file read, memory corruption, or denial of service, and strongly urged users to upgrade. Advisory metadata for **CVE-2026-62948** indicates proof-of-concept exploitation exists, although exploitation is not considered automatable.
Jul 15, 2026