Executive brief
OpenWrt LuCI is a web-based administration interface for OpenWrt routers. A misconfigured access control list (ACL) in the mount management module accidentally grants ordinary users the ability to write to the root user's cron job file, allowing them to execute arbitrary commands with administrative privileges. An attacker with any valid LuCI account can exploit this within minutes to gain full control of the router.
Technical details
The vulnerability is a privilege escalation caused by an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root. The root cause is a copy-paste error during ACL reorganization in 2020; the /etc/crontabs/root write entry was intended only for the luci-mod-system-cron group but was duplicated into the luci-mod-system-mounts group, which is designed solely for filesystem mount management. An authenticated user with only the mount-configuration ACL permission can abuse the ubus file.write method to append arbitrary cron entries to /etc/crontabs/root. Since busybox crond is enabled and running by default, the injected cron jobs are executed as root within one minute. The attack requires only network access and valid LuCI credentials; no additional code execution primitives are needed. The vulnerability has affected all OpenWrt releases since April 2020, including version 25.12.4, with no patch released at the time of disclosure.
Affected products
- OpenWrt LuCI all versions from 2020-04-09 onwards, including 25.12.4
Timeline
- 2026-08-13: disclosed
- 2020-04-09: other: Vulnerability introduced by commit c099344013 in 2020-04-09