Arbitrary Command Execution Vulnerability in OpenWrt LuCI Application

CVE-2026-55897

What is CVE-2026-55897?

The luci-app-advanced-reboot application for OpenWrt allows users to reboot their routers or change firmware partitions through a web interface. However, prior to version 1.1.2-6, it had a vulnerability that permitted authenticated users to execute arbitrary commands as root. This was due to insufficient access controls within the application, specifically related to how it passed user-supplied parameters to the shell. Versions like openwrt-24.10 and openwrt-23.05 that do not grant execute permissions to /bin/sh are unaffected. Ensure to update to at least version 1.1.2-6 to mitigate this risk.

References