CVE-2026-55897
Received Received - Intake

Command Injection in luci-app-advanced-reboot for OpenWrt

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-55897
EUVD
EUVD-2026-84101

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
openwrt luci-app-advanced-reboot to 1.1.2-6 (exc)
mossdef-org luci-app-advanced-reboot to 1.1.2-6 (exc)
mossdef-org luci-app-advanced-reboot 1.1.2-6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects luci-app-advanced-reboot, a LuCI web interface application for OpenWrt. It allows authenticated users with read-only access to execute arbitrary commands as root by exploiting an insecure access control list (ACL) that grants file execution permissions on /bin/sh. The issue was fixed in version 1.1.2-6.

Detection Guidance

Check if luci-app-advanced-reboot version 1.1.2-5 or earlier is installed on your OpenWrt system. Verify the ACL configuration in /usr/share/rpcd/acl.d/luci-app-advanced-reboot.json for /bin/sh execution permissions. Look for unauthorized root command execution attempts in system logs.

Impact Analysis

An attacker with read-only access could execute root-level commands, compromising the system's confidentiality, integrity, and availability. This could lead to unauthorized data access, system manipulation, or denial of service.

Compliance Impact

This vulnerability allows authenticated users with read-only access to execute arbitrary commands as root, compromising system integrity and confidentiality. Such unauthorized root access could lead to violations of GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive data or system modifications.

Mitigation Strategies

Upgrade luci-app-advanced-reboot to version 1.1.2-6 or later. Remove /bin/sh from the read ACL in the application's ACL file. Avoid granting file.exec permissions on shell interpreters in read ACLs. Restrict write access to privileged actions like boot partition changes and system reboot.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart