OpenWrt LuCI EUVD-2026-40172

Exploitation requires an authenticated LuCI session belonging to a user who has OpenVPN protocol configuration access, and the device must have the luci-proto-openvpn module installed and reachable. The concrete trigger is supplying shell metacharacters in the cl_meta parameter of the generateKey ubus method, which is interpolated unquoted into a popen() shell command. Limiting factors: it is not pre-authentication (PR:L) and not exploitable by an arbitrary unauthenticated network user, so it functions as escalation from a constrained LuCI/OpenVPN-admin role to root; it also depends on the OpenVPN protocol UI being present and the management interface being network-reachable to the attacker. No user interaction by a victim is required (UI:N).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity attack requiring low privileges and no user interaction, yielding high impact across all three security properties - a credible priority for any exposed OpenWrt device. The key mitigating signal is PR:L: the attacker must already be an authenticated LuCI user holding OpenVPN configuration rights, so this is a privilege-escalation-to-root primitive rather than a pre-auth takeover. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so real-world exploitation probability cannot be quantified from the input; the absence of these signals should not be read as low risk given the trivial exploitation mechanics once authenticated. The principal real-world risk is environments where LuCI accounts are shared, weakly protected, or where a lower-trust admin role can reach OpenVPN settings, effectively collapsing the boundary between web-admin and root.

A user with a low-privilege LuCI account that can edit OpenVPN protocol settings navigates to the OpenVPN configuration and submits a cl_meta value containing shell metacharacters (for example appending '; <command>' or '$(<command>)'). When generateKey is invoked over ubus, the injected payload is executed by popen() as root, giving the attacker a root shell or persistence on the router. No public proof-of-concept is identified at time of analysis, but the network attack vector and low complexity make weaponization straightforward for an authenticated user.