CVE-2026-55159 Details
Description
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.
A vulnerability in the LuCI application 'luci-app-adblock-fast' for OpenWrt allows authenticated users with write access to the application to inject newline characters into cron schedule entries. This injection creates additional cron jobs that execute commands as the root user. The issue arises because the application does not properly validate the 'entry' argument of the 'setCronEntry' RPC method, allowing for the creation of unauthorized cron tasks that are executed with elevated privileges.
Users can update to 'luci-app-adblock-fast' version 1.2.4-2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/luci/commit/9ccd99b5898457e5ef39dc21aea226d7fb6e5c7e | [email protected] | Source CodeVendor |
| https://github.com/openwrt/luci/commit/f67461fd0255bf992b2b559c22ec288067f2f9da | [email protected] | Source CodeVendor |
| https://github.com/openwrt/luci/pull/8705 | [email protected] | Issue TrackingVendor |
| https://github.com/openwrt/luci/security/advisories/GHSA-ggpf-xrph-wg5v | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenWrt luci-app-adblock-fast | < 1.2.4-2 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | New CVE Received | [email protected] |