anonhaven

CVE-2026-55159

HIGH CVSS 3.1: 8.8 EPSS 0.49%
Updated Sep 25, 2026
luci-app-adblock-fast
Parameter Value
CVSS 8.8 (HIGH)
Fixed In 1.2.4
Type CWE-93
Vendor luci-app-adblock-fast
Public PoC No

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs.

The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service

CVSS Vector v3.1

Weakness Type (CWE)

CWE-93

References 4

https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e
security-advisories@github.com
https://github.com/openwrt/luci/commit/f67461fd0255bf992b2b559c22ec288067f2f9da
security-advisories@github.com
https://github.com/openwrt/luci/pull/8705
security-advisories@github.com
https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v
security-advisories@github.com
Share Post Share Share Share