luci-app-adblock-fast CVE-2026-55159

Requires an authenticated LuCI account that has been granted the luci-app-adblock-fast write ACL - a delegated/limited-privilege role, not a full admin, and explicitly not an unauthenticated user or a user lacking that specific ACL. The target must run luci-app-adblock-fast prior to 1.2.4-2 on OpenWrt with the setCronEntry RPC exposed (rpcd/ucode/luci.adblock-fast). Exploitation succeeds because the RPC does not strip carriage-return/line-feed from the 'entry' argument before writing to /etc/crontabs/root; the limiting factors are the mandatory pre-existing write-ACL grant and reliance on cron actually running to fire the injected root job.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) is directionally sound but its network reach is materially gated by prerequisites the vector alone understates. Exploitation is NOT open to the internet at large: the description explicitly states the flaw is only demonstrated for an authenticated delegated user holding the luci-app-adblock-fast write ACL, and 'not demonstrated for unauthenticated callers or users without the component write ACL.' PR:L therefore correctly reflects an authenticated actor. The impact is severe and honest - CRLF injection into /etc/crontabs/root yields a root (UID 0) cron entry, i.e. full confidentiality/integrity/availability compromise of the router, so C:H/I:H/A:H is justified. One nuance worth flagging: because a narrowly-scoped LuCI ACL user escalates to full OS root, a Scope-changed rating (S:C) is defensible and would push the score higher - the vendor's S:U is conservative. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. Net judgment: a genuinely high-impact post-authentication privilege-escalation-to-root bug, but its real-world priority is bounded by the requirement for an existing delegated account with the specific write ACL and by the niche deployment footprint - treat as high-priority patching for anyone who has provisioned delegated LuCI users on OpenWrt, but not an internet-facing spray-and-pray threat.

An operator has delegated limited LuCI access to a semi-trusted user, granting only the luci-app-adblock-fast write ACL. That user calls the setCronEntry RPC with an 'entry' value containing an embedded carriage-return/line-feed, which the ucode backend writes verbatim into /etc/crontabs/root, appending an attacker-controlled physical cron line that executes an arbitrary command as UID 0 the next time cron fires. No public proof-of-concept is referenced in the supplied data; exploitation is straightforward given the required ACL because attack complexity is low.