Skip to main content

luci-app-samba4 CVE-2026-59260

| EUVDEUVD-2026-43233 HIGH
Improper Privilege Management (CWE-269)
2026-07-12 VulnCheck GHSA-7pqv-wj3v-fcq3
Privilege Escalation Luci
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable LuCI/ubus with low complexity but requires an authenticated delegated account (PR:L); execution as root yields full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 12, 2026 - 12:44 vuln.today

DescriptionCVE.org

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.

AnalysisAI

Privilege escalation to root in OpenWrt's luci-app-samba4 (LuCI web interface) lets authenticated delegated users invoke the root-owned Samba daemon with attacker-controlled arguments. The package's 'read' ACL improperly grants file.exec permission on /usr/sbin/smbd, so a low-privileged operator can launch smbd with global options like 'message command' and achieve arbitrary command execution as root when SMB messages are processed. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate as delegated read user
Delivery
Invoke smbd via file.exec ACL
Exploit
Pass malicious 'message command' global option
Execution
Root smbd processes SMB message
Impact
Arbitrary command executes as root
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must possess a valid authenticated LuCI/ubus account assigned the delegated 'read' ACL role (PR:L) on a device running the vulnerable luci-app-samba4 package with the smbd file.exec grant present. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 High and is internally consistent: network reachable, low complexity, but requires an authenticated delegated (low-privileged) account (PR:L), yielding full confidentiality/integrity/availability compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker holding a delegated OpenWrt account with only the 'read' role authenticates to the LuCI/ubus interface over the network, then uses the improperly granted file.exec permission to launch /usr/sbin/smbd with a crafted global option such as 'message command=<attacker shell command>'. When an SMB message is processed, the root smbd executes the supplied command, giving the low-privileged user full root code execution on the router. …
Remediation Apply the fix from the OpenWrt LuCI security advisory GHSA-vx64-mmp7-h36c (https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c); a patch is available per that vendor advisory, but a released, tagged fixed version is not independently confirmed in the available data, so update luci-app-samba4 to the corrected package once your feed publishes it (opkg/apk update then upgrade). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 HOURS: Inventory all OpenWrt deployments with luci-app-samba4; restrict LuCI administrative interface access to authorized administrators only (network whitelist/VPN requirement); disable luci-app-samba4 on systems where Samba4 is not required. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Luci

View all
CVE-2019-12272 CRITICAL
9.8 May 23

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_st
CVE-2026-61876 CRITICAL
9.4 Jul 12

Stored cross-site scripting in OpenWrt's LuCI web interface lets an adjacent-network attacker inject executable HTML/Jav
CVE-2023-24181 MEDIUM POC
5.4 Apr 10

LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vuln
CVE-2022-41435 MEDIUM POC
5.4 Nov 03

OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerabilit
CVE-2020-10871 MEDIUM POC
5.3 Mar 23

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. Rat
CVE-2026-58000 HIGH
8.7 Jun 29

Root command injection in OpenWrt's LuCI web interface (luci-proto-openvpn through 0.11.1) lets an authenticated user wi
CVE-2026-62184 HIGH
8.7 Jul 13

Ban-list poisoning in OpenWrt's luci-app-banip (banIP) before 1.8.10 lets an unauthenticated remote attacker steer the a
CVE-2026-61875 HIGH
8.7 Jul 12

Stored cross-site scripting in OpenWrt's luci-app-upnp lets an unauthenticated LAN client persist a JavaScript payload t
CVE-2026-32721 HIGH
8.6 Mar 19

A stored cross-site scripting (XSS) vulnerability exists in the OpenWrt LuCI web interface where malicious JavaScript co
CVE-2026-57999 HIGH
7.7 Jun 29

Authenticated root command injection in the OpenWrt LuCI community Tailscale app (luci-app-tailscale-community) lets a l
CVE-2021-27821 MEDIUM
6.1 May 25

The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerabil
CVE-2013-4482 MEDIUM
6.2 Nov 23

Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the initscrip

Same weakness CWE-269 – Improper Privilege Management

View all
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2012-3993 CRITICAL POC
9.3
CVE-2017-11467 CRITICAL POC
9.8
CVE-2014-1510 CRITICAL POC
9.8
CVE-2014-1511 CRITICAL POC
9.8
CVE-2016-0151 HIGH POC
7.8
CVE-2013-0643 HIGH
8.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2026-59260 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy