CVE-2026-55159
Received Received - Intake

Command Injection in luci-app-adblock-fast for OpenWrt

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-55159
EUVD
EUVD-2026-84099

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openwrt luci-app-adblock-fast to 1.2.4-2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in luci-app-adblock-fast versions prior to 1.2.4-2. It allows an authenticated delegated user with write access to inject newline characters into a cron entry via the luci.adblock-fast.setCronEntry RPC method. The backend fails to sanitize the entry argument, treating each newline as a separate cron entry. This results in additional arbitrary cron entries being appended to /etc/crontabs/root, leading to persistent root command execution when cron runs.

Detection Guidance

Check for unauthorized cron entries in /etc/crontabs/root by running: cat /etc/crontabs/root. Look for unexpected entries or modifications. Verify if luci-app-adblock-fast is outdated by checking installed version: opkg list-installed | grep luci-app-adblock-fast.

Impact Analysis

An attacker with limited privileges can escalate to root access by injecting malicious cron entries. This allows full control over the system, including executing arbitrary commands as root, installing malware, modifying system files, or disrupting services. The impact is severe due to the persistent nature of cron jobs and the high privileges gained.

Compliance Impact

This vulnerability allows authenticated users with limited privileges to execute arbitrary commands as root by injecting malicious cron entries. This could lead to unauthorized data access, modification, or exfiltration, violating GDPR data protection principles and HIPAA security requirements for access controls and integrity.

Mitigation Strategies

Upgrade luci-app-adblock-fast to version 1.2.4-2 or later using: opkg update && opkg upgrade luci-app-adblock-fast. Remove the setCronEntry RPC method if present by checking RPC ACLs and disabling it.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart