CVE-2026-55897 Details
Description
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.
A vulnerability in the luci-app-advanced-reboot package for OpenWrt's LuCI web interface allows authenticated users with delegated sessions to execute arbitrary commands as root. This issue arises from the application's read access control list (ACL) granting permission to execute the general shell interpreter /bin/sh through rpcd's file.exec API. The vulnerability is present in OpenWrt LuCI master and openwrt-25.12 snapshots that include this ACL grant, but not in openwrt-24.10 or openwrt-23.05 branches.
Users can update to luci-app-advanced-reboot version 1.1.2-6, which removes the /bin/sh exec grant from the ACL and addresses the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f | [email protected] | Source CodeVendor |
| https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829 | [email protected] | Source CodeVendor |
| https://github.com/openwrt/luci/pull/8710 | [email protected] | Issue TrackingVendor |
| https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenWrt LuCI | master openwrt-25.12 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |