luci-app-banip CVE-2026-62184

Exploitation requires that banIP's log-monitoring feature is enabled with a Log Term matching a log source that echoes an attacker-controlled free-form field (classically a failed-login username, but any monitored line reflecting unvalidated input works), and that the monitored service is reachable by the attacker to generate such log entries. No authentication and no user interaction are needed (PR:N/UI:N), and configurations that monitor auth/login logs are exploitable out of the box. The key limiting factors are deployment-specific: the device must run vulnerable luci-app-banip (<=1.8.9) with log monitoring active on a log format where the forged IP precedes the genuine source IP on the line, and impact is limited to availability/denial-of-blocking - it cannot yield code execution or data disclosure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.7 High) is internally consistent with the description: remote, low-complexity, unauthenticated, no user interaction, and impact confined to availability (VA:H) with no confidentiality or integrity loss. This is a logic/abuse-of-function flaw rather than code execution - the attacker cannot run code or read data, but can cause denial of service by inducing banIP to block legitimate third parties (self-inflicted blocking of trusted IPs or ranges) while evading blocking themselves, defeating the control's purpose. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so probabilistic exploitation signals are unavailable and should not be presented as if favorable or unfavorable; realistic priority is driven by the CVSS profile plus the fact that exploitation only requires sending log-generating traffic with a spoofed IP embedded. The impact is bounded: it degrades a defensive control and can cause targeted DoS of specific victims, but does not compromise the host itself.

An attacker repeatedly hits an internet-facing service on the OpenWrt device (for example SSH or a web login) using a username crafted to contain a spoofed IPv4 string such as the address of a legitimate partner or upstream service. banIP's log monitor extracts that injected address from the failed-login log line and adds it to the firewall ban set, cutting off the innocent victim while the attacker's real source IP continues unblocked. No public POC is identified, but the technique is straightforward given the low attack complexity and lack of authentication.