Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-72840

OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

openwrt luci

Default version status: unaffected

  • 0 to ≤ 24.10.8affected
  • 25.12.0 to ≤ 25.12.5affected

References