Junglewise Threat Intelligence

CVE-2026-58652: OpenWrt luci-app-travelmate privilege escalation to root via UCI script parameter

CVE-2026-58652 · Severity: high · CVSS 7.5 · Published 2026-07-02

Vendors: OpenWrt.

Executive brief

The travelmate application, used on OpenWrt routers to automate connections to hotel and public Wi-Fi networks, contains a security flaw that allows for unauthorized command execution. An attacker who has been granted limited administrative access to manage travelmate settings can bypass interface restrictions to run arbitrary commands as the system's root user. This could lead to a complete takeover of the router, allowing an attacker to intercept network traffic or disable security features.

Technical details

A privilege escalation vulnerability exists in luci-app-travelmate and the underlying travelmate package due to insecure handling of UCI configuration values. While the LuCI web interface attempts to restrict the 'script' parameter to specific login files, this is only a frontend validation. The backend travelmate service, running as root, reads the raw 'script' and 'script_args' values from the UCI configuration and executes them via travelmate-functions.sh when a captive portal is detected. An attacker with delegated write permissions to the travelmate configuration can set the script to an interpreter like /bin/sh and provide malicious arguments, resulting in arbitrary command execution as root. As of the advisory date, no patched version is known, though the flaw is confirmed in versions 2.4.5-r3 and 2.4.6-1.

Affected products

  • OpenWrt luci-app-travelmate 2.4.5-r3, 2.4.6-1
  • OpenWrt travelmate 2.4.5-r3, 2.4.6-1

Timeline

  • 2026-06-17: advisory: Initial GHSA advisory published by researcher
  • 2026-07-02: disclosed: CVE published to NVD

References