Skip to main content

OpenWrt LuCI CVE-2026-72840

| EUVDEUVD-2026-58548 HIGH
Incorrect Privilege Assignment (CWE-266)
2026-08-13 disclosure@vulncheck.com GHSA-6vfc-74mf-qrmj
Information Disclosure
8.7
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Scope changes to root via crond execution (S:C); low-privilege authenticated LuCI account required (PR:L); network-reachable interface (AV:N); no complexity barriers in the write-then-wait mechanism (AC:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 22:32 vuln.today
CVE Published
Aug 13, 2026 - 22:17 cve.org
HIGH 8.7

DescriptionCVE.org

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

AnalysisAI

Root code execution in OpenWrt LuCI via luci-mod-system-mounts allows authenticated users holding only mount-configuration ACL rights to overwrite the system crontab and execute arbitrary commands as root within 60 seconds. The flaw is a misconfigured ACL definition that incorrectly extends write access to /etc/crontabs/root - a file that should be inaccessible to mount-only operators - through the ubus file.write RPC interface. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to LuCI with mount-config ACL account
Delivery
Issue ubus file.write RPC call targeting /etc/crontabs/root
Exploit
Append malicious cron entry to root crontab
Execution
Busybox crond polls crontab within 60 seconds
Impact
Execute arbitrary command as root on router
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated LuCI session where the authenticated account holds membership in the mount-configuration ACL group - the ACL group defined by luci-mod-system-mounts and intended only for storage and mount-point management. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H accurately reflects the severity profile: network-reachable, zero attack complexity, requiring only a low-privilege LuCI account in the mount-configuration ACL group, and yielding full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a delegated LuCI operator account - for example, an account provisioned for storage mount management on a shared-access or ISP-managed router - authenticates to the LuCI web interface and issues a crafted ubus file.write RPC call targeting /etc/crontabs/root, appending a reverse shell payload or arbitrary command. Within 60 seconds, the default busybox crond daemon reads the modified crontab and executes the injected entry with root privileges, granting the attacker full control of the router's operating system. …
Remediation The primary remediation is to apply the corrected ACL definition from the upstream fix, details of which are documented in the GitHub security advisory at https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openwrt-luci-luci-mod-system-mounts-acl-root-rce-via-crontab-write. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all OpenWrt deployments with LuCI enabled and document which user accounts hold mount-configuration ACL group membership. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2022-20759 HIGH POC
8.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-72840 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy