Which versions of luci-app-bmx7 are affected by CVE-2026-69095?

OpenWrt routers running luci-app-bmx7 can be remotely accessed without authentication to extract sensitive files including credentials and cryptographic keys.. A patch is available.

How to fix or mitigate CVE-2026-69095?

Within 24 hours, identify and inventory all OpenWrt devices running luci-app-bmx7 and assess network exposure of their management interfaces. Within 7 days, apply the vendor-released patch to all affected systems and verify successful deployment. Within 30 days, conduct forensic review of exposed devices for unauthorized file access, rotate credentials stored on affected routers, and implement network access controls to restrict management interface connectivity.

luci-app-bmx7 CVE-2026-69095

Q: What is the CVSS score of CVE-2026-69095?

CVE-2026-69095 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-52288 HIGH

Path Traversal (CWE-22)

2026-08-03 VulnCheck

GHSA-4q7q-8m76-5rv8

Path Traversal Openwrt Luci

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable CGI requiring no authentication (AV:N, PR:N, AC:L); read-only path traversal yields no integrity or availability impact (I:N, A:N, S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 14:21 vuln.today

Patch available

Aug 03, 2026 - 14:02 EUVD

CVE Published

Aug 03, 2026 - 13:20 cve.org

HIGH 8.7

DescriptionCVE.org

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.

AnalysisAI

Unauthenticated path traversal in OpenWrt's luci-app-bmx7 package exposes arbitrary files on affected routers via the bmx7-info CGI endpoint. Attackers can supply directory traversal sequences in the CGI query string to escape the configured runtimeDir and read any file readable by the CGI process, including credentials, network configuration, or cryptographic keys stored on the device. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated network attack vector (CVSS 4.0: 8.7) presents a low barrier to opportunistic exploitation against exposed management interfaces.

Technical ContextAI

The affected component is the bmx7-info CGI script within luci-app-bmx7, a LuCI plugin that surfaces runtime data for the BMX7 (Batman eXperimental mesh v7) mesh routing protocol on OpenWrt - a Linux-based firmware for embedded network devices such as routers and wireless access points. The script is designed to return information scoped to a configured runtimeDir, but CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) describes the root cause: user-supplied path components in the HTTP query string are not sanitized or canonicalized before filesystem path construction, allowing sequences such as '../' to traverse beyond the intended directory boundary. The affected CPE is cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*, covering all LuCI revisions prior to the fix commit. The vulnerability is scoped to devices where luci-app-bmx7 is explicitly installed, as it is not a default OpenWrt package.

RemediationAI

Update the luci-app-bmx7 package to a version incorporating commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd or later, as documented in the vendor security advisory at https://github.com/openwrt/luci/security/advisories/GHSA-8qcq-jgrj-gvmj; a specific tagged release version was not independently confirmed in the available intelligence, so verify the installed commit hash post-update. If an immediate update is not feasible, restrict network access to the LuCI web interface to trusted management networks or VPN-only access, eliminating the network-reachable attack vector - this is the single most effective compensating control, with no functional impact to router operation. Alternatively, uninstall the luci-app-bmx7 package if BMX7 mesh routing is not actively required; removal has no effect on core OpenWrt functionality. As a general hardening measure, ensure the LuCI admin interface is never exposed on the WAN interface.