CVE-2026-62184: OpenWrt luci-app-banip improper input validation in log parser

CVE-2026-62184 · Severity: high · CVSS 7.5 · Published 2026-07-13

A vulnerability in the banIP intrusion prevention system for OpenWrt allows attackers to trick the software into blocking innocent users or critical internet services. By including a specific IP address in a login attempt's username field, an attacker can force the system to ban that IP instead of their own. This can be used to cause widespread service outages, such as blocking DNS servers or upstream routers, effectively cutting off the network's internet access.

Technologies: OpenWrt LuCI. Vendors: OpenWrt.

Quick answers

Is CVE-2026-62184 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62184 being exploited in the wild.
How severe is CVE-2026-62184?
High severity, with a CVSS score of 7.5, published 13 July 2026.
Which products and versions are affected?
OpenWrt LuCI <= 1.8.9-r2; OpenWrt Luci-App-Banip <= 1.8.9-r2.
Is there a fix for CVE-2026-62184?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-62184 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-62184?
Check whether you run OpenWrt LuCI or OpenWrt Luci-App-Banip at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The banIP log monitoring engine (f_monitor function in /usr/lib/banip-functions.sh) uses an awk-based parser to identify attackers by extracting the first IPv4 address found in a log line via a regex match. In many log formats, such as LuCI login failures, attacker-controlled fields like the username appear before the actual source IP. An unauthenticated remote attacker can provide a target IP address as their username during a failed login attempt. The parser incorrectly identifies this injected IP as the source of the attack and adds it to the nftables blocklist, resulting in a Denial of Service (DoS) against the spoofed IP while the attacker remains unblocked. The issue is fixed by modifying the parser to use absolute field positioning (e.g., matching the IP following the 'from' keyword) rather than the first occurrence in the string.

Affected products

  • OpenWrt luci-app-banip <= 1.8.9-r2
  • OpenWrt luci <= 0.11.1

Timeline

  • 2026-06-28: advisory: GitHub Security Advisory published
  • 2026-07-13: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.