Executive brief
A security flaw in the OpenWrt Samba management interface allows users who are supposed to have limited, read-only access to take full control of the device. By exploiting a misconfiguration in how permissions are assigned, an authorized user can run the Samba service with custom settings that trigger the execution of malicious commands. This could lead to a complete system takeover, allowing an attacker to access sensitive data or disrupt network operations.
Technical details
A privilege escalation vulnerability exists in the OpenWrt luci-app-samba4 package due to improper privilege management in its Access Control List (ACL) configuration. The 'read' ACL incorrectly grants 'file.exec' permissions for the /usr/sbin/smbd binary to delegated users. An authenticated attacker with these permissions can use the rpcd 'file.exec' function to launch a temporary smbd instance with arbitrary command-line arguments. By passing specific Samba global options (such as 'message command') via the '--option' flag and then triggering the SMB1 message path, the attacker can execute arbitrary commands with root privileges. The vulnerability requires an authenticated LuCI/rpcd session with at least read-only Samba permissions.
Affected products
- OpenWrt luci-app-samba4 Tested with 26.158.66357~46cd823; all versions prior to patch
- OpenWrt samba4-server Tested with 4.22.7-r3
Timeline
- 2026-06-27: advisory: Initial GitHub Security Advisory published
- 2026-07-12: disclosed: CVE published to NVD dataset