Privilege Escalation Vulnerability in OpenWrt Operating System

CVE-2026-30874

What is CVE-2026-30874?

A security vulnerability identified in the OpenWrt operating system enables attackers to bypass filtering of sensitive environment variables through a flaw in the hotplug_call function. By exploiting this vulnerability in versions prior to 24.10.6, an attacker can inject an arbitrary PATH variable, leading to the execution of malicious binaries with elevated privileges. The design intention was to block sensitive variables, but an incorrect comparison method failed to prevent access, thereby allowing unauthorized control over the execution of scripts intended for hotplug operations.

References