Executive brief
A security vulnerability exists in the OpenVPN configuration module for OpenWrt routers. An authorized user with access to VPN settings can execute malicious commands with full administrative (root) privileges on the device. This could allow an attacker to take complete control of the router, intercept network traffic, or install persistent backdoors.
Technical details
A command injection vulnerability exists in the 'generateKey' ubus method within 'luci.openvpn.uc'. The 'cl_meta' parameter is interpolated directly into a shell command string passed to the 'popen()' function without proper escaping or quoting via 'shellquote()'. While the LuCI web interface base64 encodes this field, the underlying ubus method accepts raw input. An authenticated attacker with 'luci-proto-openvpn' ACL permissions can use shell metacharacters (e.g., $(command)) to achieve arbitrary code execution as the root user. The issue is fixed in commit e4ff45e by applying proper shell quoting to the affected parameter.
Affected products
- OpenWrt luci-proto-openvpn through 0.11.1
Timeline
- 2026-06-27: advisory: GitHub Security Advisory GHSA-pm9w-522m-8rrh published
- 2026-06-29: disclosed: CVE-2026-58000 published to NVD