EUVD-2026-43233
GHSA-7pqv-wj3v-fcq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as delegated read user
-
DeliveryInvoke smbd via file.exec ACL
-
ExploitPass malicious 'message command' global option
-
ExecutionRoot smbd processes SMB message
-
ImpactArbitrary command executes as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must possess a valid authenticated LuCI/ubus account assigned the delegated 'read' ACL role (PR:L) on a device running the vulnerable luci-app-samba4 package with the smbd file.exec grant present. The concrete requirement is the ability to invoke /usr/sbin/smbd via that ACL and supply Samba global options (e.g. 'message command'); command execution then fires when an SMB protocol message is processed by the root smbd. Limiting factors: exploitation is not possible for fully unauthenticated attackers, requires the samba4 app and its delegated-user model to be deployed (not a default single-admin OpenWrt setup), and requires network reachability to the management/SMB interface. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 High and is internally consistent: network reachable, low complexity, but requires an authenticated delegated (low-privileged) account (PR:L), yielding full confidentiality/integrity/availability compromise. This is a genuine privilege-escalation priority in any deployment that hands out delegated LuCI accounts, because it converts a read-only operator into root. However real-world urgency is tempered by the PR:L precondition - an attacker must already possess a valid delegated login - so this is not a pre-auth mass-exploitation bug. No EPSS score, KEV entry, or public POC is present in the provided data, so likelihood signals are weak/absent; treat exploitation as plausible-but-not-observed. The subsequent-system metrics (SC/SI/SA:N) and CVSS 4.0's non-scope model understate that the practical effect crosses a trust boundary from a restricted role to root, so the operational impact is arguably higher than the 'no scope change' framing suggests. |
| Exploit ScenarioDerived | An attacker holding a delegated OpenWrt account with only the 'read' role authenticates to the LuCI/ubus interface over the network, then uses the improperly granted file.exec permission to launch /usr/sbin/smbd with a crafted global option such as 'message command=<attacker shell command>'. When an SMB message is processed, the root smbd executes the supplied command, giving the low-privileged user full root code execution on the router. No public POC is identified at this time, but low attack complexity makes weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 12, 2026
Privilege escalation to root in OpenWrt's luci-app-samba4 (LuCI web interface) lets authenticated delegated users invoke the root-owned Samba daemon with attacker-controlled arguments. The package's 'read' ACL improperly grants file.exec permission on /usr/sbin/smbd, so a low-privileged operator can launch smbd with global options like 'message command' and achieve arbitrary command execution as root when SMB messages are processed. Reported by VulnCheck with a GHSA advisory published; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fix from the OpenWrt LuCI security advisory GHSA-vx64-mmp7-h36c (https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c); a patch is available per that vendor advisory, but a released, tagged fixed version is not independently confirmed in the available data, so update luci-app-samba4 to the corrected package once your feed publishes it (opkg/apk update then upgrade). As an immediate compensating control, remove or tighten the offending ACL by editing the samba4 ACL definition (under /usr/share/rpcd/acl.d/) to strip the file.exec grant on /usr/sbin/smbd from the 'read' role - trade-off: delegated read users may lose intended UI functions tied to that ACL. Additionally, revoke or avoid issuing delegated LuCI accounts to untrusted users and restrict access to the LuCI/ubus interface (bind management to a trusted VLAN or firewall the HTTP/HTTPS admin port) until patched; the side effect is reduced remote manageability for legitimate low-privilege operators.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is LuCI, the OpenWrt web configuration framework, specifically the luci-app-samba4 management app. OpenWrt implements delegation through named ACL groups that map roles (like 'read') to permitted RPC/ubus operations and file actions. Here the 'read' ACL bundles a file.exec permission targeting /usr/sbin/smbd - the Samba 4 file-sharing daemon that normally runs as root. This is a textbook CWE-269 (Improper Privilege Management): a permission intended to be low-trust (read) is over-scoped to allow executing a privileged binary. Because smbd honors command-line/global configuration overrides such as 'message command' (which specifies a shell command executed on receipt of a Windows WinPopup/SMB message), controlling smbd's arguments is equivalent to controlling root shell execution.
Know when Openwrt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable LuCI/ubus with low complexity but requires an authenticated delegated account (PR:L); execution as root yields full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.
Executive ViewAI
A privilege escalation vulnerability in OpenWrt's LuCI web interface for Samba4 configuration allows authenticated administrators to gain root-level command execution on affected network devices, enabling complete compromise of file sharing services and potentially the broader network infrastructure. Although no public exploit code has been identified to date, the vulnerability is trivial to exploit by any operator with LuCI access. Organizations deploying OpenWrt with delegated administrative access face immediate risk of insider threats or compromised accounts leading to full system compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict LuCI administrative access to authorized personnel only with network-level access control; (2) Disable luci-app-samba4 on non-critical systems; (3) Implement network segmentation to isolate affected devices from sensitive business systems; (4) Enable SMB server logging and configure alerts for suspicious message command usage or configuration changes; (5) Conduct quarterly administrative access reviews for OpenWrt systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS
Stored cross-site scripting in OpenWrt's LuCI web interface lets an adjacent-network attacker inject executable HTML/Jav
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. Rated high severity (CVS
An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used o
cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
Remote privilege escalation in Android WLAN AP driver via packet injection.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
Exploit-DB