Executive brief
A vulnerability in the banIP intrusion prevention system for OpenWrt allows attackers to trick the software into blocking innocent users or critical internet services. By including a specific IP address in a login attempt's username field, an attacker can force the system to ban that IP instead of their own. This can be used to cause widespread service outages, such as blocking DNS servers or upstream routers, effectively cutting off the network's internet access.
Technical details
The banIP log monitoring engine (f_monitor function in /usr/lib/banip-functions.sh) uses an awk-based parser to identify attackers by extracting the first IPv4 address found in a log line via a regex match. In many log formats, such as LuCI login failures, attacker-controlled fields like the username appear before the actual source IP. An unauthenticated remote attacker can provide a target IP address as their username during a failed login attempt. The parser incorrectly identifies this injected IP as the source of the attack and adds it to the nftables blocklist, resulting in a Denial of Service (DoS) against the spoofed IP while the attacker remains unblocked. The issue is fixed by modifying the parser to use absolute field positioning (e.g., matching the IP following the 'from' keyword) rather than the first occurrence in the string.
Affected products
- OpenWrt luci-app-banip <= 1.8.9-r2
- OpenWrt luci <= 0.11.1
Timeline
- 2026-06-28: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date