CVE-2026-72840

Received Received - Intake

LuCI ACL Bypass Allows Root Cron Job Execution

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72840

EUVD

EUVD-2026-58548

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

OpenWrt LuCI has an overly permissive access control list (ACL) in the luci-mod-system-mounts component. This allows users with only mount-configuration privileges to write files to /etc/crontabs/root. These files are executed as root by the busybox crond daemon within one minute, enabling privilege escalation.

Detection Guidance

Check for unauthorized cron entries in /etc/crontabs/root by running: cat /etc/crontabs/root. Also inspect file.write calls via ubus for suspicious activity: ubus call file write '{"path":"/etc/crontabs/root","data":"<malicious_entry>"}'.

Impact Analysis

An authenticated attacker with limited privileges could exploit this to execute arbitrary commands as the root user. This could lead to full system compromise, data theft, or denial of service on the affected device.

Compliance Impact

This vulnerability could lead to unauthorized root access, potentially violating data protection requirements under GDPR or HIPAA. It may result in unauthorized data access, modification, or exfiltration, leading to compliance breaches.

Mitigation Strategies

Remove write access to /etc/crontabs/root for non-root users. Restrict ubus file.write permissions. Update OpenWrt LuCI to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-72840. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70