luci-app-advanced-reboot CVE-2026-55897

Exploitation requires (1) an authenticated delegated rpcd/LuCI session whose ACL includes the luci-app-advanced-reboot read permission, and (2) a build of luci-app-advanced-reboot prior to 1.1.2-6 that actually ships the read ACL granting rpcd file.exec for the general shell interpreter /bin/sh (in root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json). Given both, the caller supplies attacker-controlled params that rpcd forwards to /bin/sh, running arbitrary commands as root. Key limiters: the vendor states builds WITHOUT the /bin/sh exec grant - explicitly the checked openwrt-24.10 and openwrt-23.05 branches - are NOT affected by this chain, and a valid low-privilege delegated session carrying the read ACL is mandatory (no unauthenticated path).

The CVSS 8.8 (High) rating rests on a self-consistent vector: AV:N/AC:L/PR:L/UI:N with full C:H/I:H/A:H, reflecting authenticated-but-low-privilege network access that escalates to arbitrary root command execution - a genuine privilege-escalation-to-RCE primitive on the router. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so this is 'no public exploit identified at time of analysis' and NOT confirmed active exploitation. The signals therefore do not conflict but do temper each other: the technical impact is severe (root on a network gateway), yet real-world urgency is bounded by two hard prerequisites the description states explicitly - the attacker must already hold an authenticated delegated rpcd session carrying the app's read ACL, AND the deployed build must actually ship the /bin/sh file.exec grant (the checked openwrt-24.10 and openwrt-23.05 branches do NOT, and are unaffected). This is a real priority for the specific vulnerable builds because it yields root, but the gating (valid delegated session + affected build) keeps it from being mass-exploitable. Net: patch-worthy where the vulnerable ACL ships, but not an internet-wide emergency absent KEV/EPSS/POC evidence.

An attacker holding a legitimate but low-privilege OpenWrt delegated login whose ACL includes the luci-app-advanced-reboot read permission calls the rpcd file.exec method, which the vulnerable ACL authorizes for /bin/sh, and supplies attacker-chosen arguments. rpcd passes those arguments to the shell, executing arbitrary commands as root and giving full control of the router. No public POC or exploit code is identified in the available intelligence; exploitation requires an existing authenticated session and a build that ships the /bin/sh exec grant.