luci-app-bmx7 EUVD-2026-52288

The luci-app-bmx7 package must be explicitly installed on the target OpenWrt device - it is not included in default OpenWrt builds and must be added by an administrator for BMX7 mesh routing support. The LuCI web interface must be network-reachable from the attacker's position; this most commonly means the admin interface is accessible on the LAN segment or, in higher-risk deployments, directly exposed on a WAN or untrusted interface. No authentication is required (PR:N per CVSS 4.0 vector) and no special runtime configuration beyond package installation is necessary. Exploitation is bounded by: the non-default nature of luci-app-bmx7 (substantially narrows the exposed population), the read permissions of the CGI process user (attacker can only access files the process is permitted to read), and network reachability to the management interface. There is no user interaction dependency.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) correctly reflects a low-friction attack: no authentication, no complexity, no user interaction needed against a network-exposed CGI script. This is not a high-score-but-low-real-risk situation for devices where the conditions are met - a trivially scriptable read primitive against router firmware is a credible threat. However, real-world risk is meaningfully bounded by the non-default, niche nature of luci-app-bmx7: it requires explicit installation for BMX7 mesh routing support, which is a specialized deployment not found in mainstream OpenWrt configurations. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. VulnCheck reported the issue and a patch is available. Risk is highest for operators who have installed the package and expose LuCI on untrusted network interfaces.

An attacker with network access to the OpenWrt device's LuCI web interface sends a crafted HTTP GET request to the bmx7-info CGI endpoint with a query parameter containing directory traversal sequences such as '../../etc/shadow' or '../../etc/config/wireless'. The CGI script constructs the target file path without sanitization, causing the process to read and return the contents of the requested file. No authentication is required, making this trivially scriptable against any reachable management interface running the vulnerable package.