Loading vulnerability…
CVE-2026-46368 is a command injection vulnerability in luci-app-https-dns-proxy through version 2025.12.29-5, an optional LuCI web UI add-on for the https-dns-proxy package distributed via the OpenWrt community packages feed. The flaw is in the setInitAction function, where the 'name' parameter supplied to the luci.https-dns-proxy setInitAction ubus RPC call is not safely handled, allowing shell metacharacter injection. An authenticated user with the luci.https-dns-proxy ACL permission can exploit this issue to execute arbitrary shell commands as root on the underlying device. Core OpenWrt is not affected; only systems where this optional package has been installed are vulnerable.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small standalone Python PoC exploit for CVE-2026-46368 affecting OpenWrt's luci-app-https-dns-proxy. The repository contains three files: a .gitignore, a README with vulnerability background and usage notes, and a single executable script, exploit.py, which is the main entry point. The exploit is not part of a larger framework. It uses Python requests to interact directly with the target's LuCI ubus JSON-RPC endpoint at /ubus over HTTP. The workflow is: prompt the operator for target IP, low-privileged credentials, and a desired new root password; authenticate via the ubus session.login RPC call; inspect returned ACLs to verify the user has access to luci.https-dns-proxy setInitAction; then send a crafted JSON-RPC request to luci.https-dns-proxy.setInitAction with a malicious 'name' value containing shell metacharacters. The injected payload is a shell command that pipes the chosen password twice into 'passwd root', thereby resetting the root password. If the RPC response indicates success, the script instructs the operator to SSH to the device as root using the new password. This makes the exploit an authenticated remote command-injection-to-root-takeover PoC rather than a mere detector. The payload is hardcoded to password reset behavior, so the exploit is best classified as OPERATIONAL rather than fully weaponized. Notable targeting details: the README states affected versions are through 2025.12.29-5, while the script header broadly says all versions prior to 2026-01-17; both indicate the vulnerable component is the luci.https-dns-proxy ubus RPC handler, specifically setInitAction. The exploit requires valid credentials and the relevant ACL permission, so it is not unauthenticated. No external C2, callback, or third-party infrastructure is used; all network interaction is directed at the target router's local web/RPC interface.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.