luci-app-adblock-fast CVE-2026-68583

Exploitation requires the attacker to hold an active lower-privileged (non-admin) account on the LuCI web interface - this is the primary limiting condition. The router must be explicitly configured with multi-user LuCI access, as default OpenWrt installations typically provision a single admin account only. The second required condition is that an administrator must actively browse to the AdBlock Fast status page after the payload has been stored (UI:P per CVSS 4.0), meaning there is no self-propagating or passive trigger. The attack surface is further limited to networks where the LuCI interface is reachable (AV:N), typically the router's LAN side; exploitation from the WAN requires the LuCI interface to be deliberately exposed externally. There is no requirement for a non-default plugin configuration beyond luci-app-adblock-fast being installed and the blocklist name field being writable by the attacker's account.

The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:N/PR:L/UI:P) accurately reflects a medium-severity, multi-prerequisite issue. The PR:L metric confirms a low-privileged account is required, and UI:P indicates that administrator interaction - specifically browsing to the AdBlock Fast status page - is a hard dependency, meaningfully reducing exploitation probability. Impact metrics (VC:L/VI:L/VA:N/SC:L/SI:L/SA:N) indicate limited direct confidentiality and integrity exposure per individual action, though the same-origin execution context elevates actual risk above raw scores suggest: JavaScript running under the LuCI origin can interact with all router admin APIs, potentially chaining this XSS into full administrative compromise. There is no CISA KEV listing and no public proof-of-concept, indicating this is not currently being actively exploited at scale. The real-world risk is highest on routers explicitly configured with multiple user accounts at different privilege levels - default single-admin OpenWrt deployments are less exposed.

An attacker with a lower-privileged LuCI account navigates to the AdBlock Fast blocklist configuration page and submits a blocklist entry whose name field contains a JavaScript payload such as a script tag referencing an external resource or performing direct API calls. The payload is stored in the router configuration. When an administrator subsequently opens the AdBlock Fast status page during routine monitoring, the stored payload silently executes in their browser under the LuCI origin, potentially exfiltrating the admin session token or issuing authenticated API requests to modify firewall rules, create new admin accounts, or exfiltrate network topology data. No public proof-of-concept has been identified at time of analysis.