Which versions of OpenWrt LuCI are affected by EUVD-2026-40172?

OpenWrt's LuCI configuration interface contains a root command injection vulnerability (CVSS 8.7) allowing authenticated administrators to execute arbitrary commands with elevated privileges.. A patch is available.

How to fix or mitigate EUVD-2026-40172?

Within 24 hours: Identify all OpenWrt devices running luci-proto-openvpn 0.11.1 or earlier; restrict administrative access where possible. Within 7 days: Apply vendor patch per GHSA-pm9w-522m-8rrh; test network functionality post-remediation. Within 30 days: Verify patch deployment across all systems; audit administrative logs for unauthorized configuration changes during vulnerability window.

OpenWrt LuCI EUVD-2026-40172

Q: What is the CVSS score of EUVD-2026-40172?

EUVD-2026-40172 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

| CVE-2026-58000 HIGH

OS Command Injection (CWE-78)

2026-06-29 VulnCheck

GHSA-833j-64r7-8r2r

Command Injection Openwrt Luci

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable ubus method, low complexity, requires an authenticated OpenVPN-config LuCI user (PR:L), and root command execution gives full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 19:20 vuln.today

CVE Published

Jun 29, 2026 - 18:16 cve.org

HIGH 8.7

DescriptionCVE.org

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.

AnalysisAI

Root command injection in OpenWrt's LuCI web interface (luci-proto-openvpn through 0.11.1) lets an authenticated user with OpenVPN protocol configuration access run arbitrary commands as root. The flaw lives in the generateKey ubus method, where the cl_meta parameter is passed unescaped into a popen() shell call. No public exploit has been identified at time of analysis, but a vendor advisory (GHSA-pm9w-522m-8rrh) and fix commit exist, and the CVSS 4.0 score of 8.7 reflects full confidentiality, integrity, and availability impact on the affected device.

Technical ContextAI

LuCI is the default Lua/JavaScript web administration framework shipped on OpenWrt embedded Linux devices, and luci-proto-openvpn is the LuCI sub-module that exposes OpenVPN as a configurable network protocol. The vulnerability is a classic CWE-78 OS command injection: the generateKey method exposed over ubus (OpenWrt's micro bus IPC layer) builds a shell command string and interpolates the attacker-controllable cl_meta parameter directly into it, then executes it via popen(). Because no shell escaping or quoting is applied, metacharacters such as ;, |, $(), or backticks break out of the intended command. ubus methods invoked from LuCI generally run with the privileges of the rpcd/uhttpd backend, which on OpenWrt is root, so successful injection yields root-level execution. The CPE cpe:2.3:a:openwrt:luci confirms the OpenWrt LuCI package as the affected component.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the patch from commit e4ff45ecbc6ad212951815c8c99b2749fbd7de6b (https://github.com/openwrt/luci/commit/e4ff45ecbc6ad212951815c8c99b2749fbd7de6b) by updating luci-proto-openvpn to a build that includes it (post-0.11.1), per the vendor advisory at https://github.com/openwrt/luci/security/advisories/GHSA-pm9w-522m-8rrh. Where immediate patching is not possible, restrict who can authenticate to LuCI and specifically who holds OpenVPN protocol configuration rights, since the attack requires that access; remove or uninstall the luci-proto-openvpn package on devices that do not use OpenVPN as a managed protocol (trade-off: OpenVPN can no longer be configured through the web UI). Additionally, ensure the LuCI/uhttpd management interface is not exposed to untrusted networks or the WAN and is reachable only over trusted management VLANs or VPN (trade-off: remote browser administration becomes unavailable from outside that segment). Enforce strong, unique LuCI credentials to reduce the chance that a low-trust account is abused to reach the vulnerable method.