CVE-2026-58387 OpenWrt LuCI advanced-reboot ACL Misconfiguration Leads to Root RCE

Vulnerability Overview Title: luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root Severity: High (CVSS 8.8/10) CVE ID: CVE-2026-58387 Description: The read ACL permission for allows the execution of via the API of rpcd. Delegated LuCI/rpcd sessions possessing the read permission for this application can invoke by passing along with caller-controlled arguments (e.g., ). Since rpcd authorizes executable paths and passes arguments as root, this effectively equates the read permission for the application to root command execution privilege. Vulnerability Type: Unauthenticated RCE (Note: Not default unauthenticated RCE; it requires an authenticated LuCI/rpcd session holding the read ACL for the application or equivalent exec privileges). Affected Scope Affected Versions: OpenWrt LuCI master and openwrt-25.12 snapshots, specifically versions including the ACL with permissions. Tested Versions: OpenWrt SNAPSHOT r54805-4271bb09d4, openwrt-24.10, openwrt-23.05. Fix Status: No known fixed version as of 2026-06-15. Vulnerable Code Location: Remediation Minimum Requirement: Remove from the read ACL of . Recommendation: Read ACLs should not grant or permissions for shell interpreters/general-purpose script interpreters. If an application requires reboot or boot-partition behavior, it should expose narrow RPC methods with fixed arguments and internal validation, rather than granting callers direct execution rights to generic binaries. Actual Fix: Fixed in PR #55105 (25.12).

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-58387 OpenWrt LuCI advanced-reboot ACL Misconfiguration Leads to Root RCE

More from this source