Executive brief
A security vulnerability exists in an optional web interface component for OpenWrt routers used to manage secure DNS traffic. An authorized user with specific permissions can execute unauthorized commands on the router with the highest level of system access (root). This could allow an attacker to take full control of the device, intercept network traffic, or change administrative passwords.
Technical details
A command injection vulnerability exists in the setInitAction function of the luci-app-https-dns-proxy package (up to version 2025.12.29-5). The root cause is improper neutralization of shell metacharacters within the 'name' parameter of a ubus RPC call. An authenticated attacker with 'luci.https-dns-proxy' ACL permissions can exploit this via the network to achieve arbitrary code execution as the root user. While core OpenWrt is unaffected, any installation using this community package is vulnerable. Public exploit code demonstrating a root password reset is available.
Affected products
- OpenWrt Community luci-app-https-dns-proxy through 2025.12.29-5
Timeline
- 2026-01-17: other: Exploit developed by researcher
- 2026-04-29: other: Exploit published to Exploit-DB
- 2026-05-26: advisory: CVE published and NVD entry created