Executive brief
A security vulnerability was identified in the build tools for OpenMPTCProuter, a solution used to aggregate multiple internet connections. The flaw exists in a script used to generate specific router images, which could allow a malicious actor to execute unauthorized commands on a developer's computer or within a build environment. This issue only affects the process of creating new software images and does not impact the security of routers already running the firmware.
Technical details
A command injection vulnerability exists in OpenMPTCProuter (up to v0.64) within the `sysupgrade-helper` component, specifically in `sysupgrade.c`. The function `create_xor_ipad_opad` utilizes `mktemp()` to create temporary files in a predictable manner without secure creation flags, leading to an insecure temporary file vulnerability (CWE-377). An attacker with access to the build environment can pre-create these files or use symlinks to redirect writes. Because these temporary filenames are subsequently concatenated into a shell command string and executed via `system()`, it results in arbitrary command execution. This vulnerability is limited to the build-time environment for RUTX platform images and does not affect runtime firmware. The affected component has been removed in recent commits.
Affected products
- Ysurac OpenMPTCProuter up to and including 0.64
Timeline
- 2025-11-15: disclosed: Issue discovered and reported to maintainers
- 2025-11-15: patched: Maintainers removed the affected package/script from the repository
- 2025-11-29: advisory: CVE reserved and public advisory published by reporter
- 2025-12-09: advisory: NVD publication date