vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-55897

luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

HIGH
8.8
CVSS Score
Published: September 21, 2026 at 07:29 PM UTC
Updated: September 24, 2026 at 09:37 PM UTC
1 product affected across 1 vendorLuci

Using luci by openwrt?

Get instant alerts when new vulnerabilities affect luci - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.8
Exploit prediction
EPSS 0.7%
SSVC
PoC

Description

luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Luci· Openwrt
60%
v < 1.1.2-6
Affected range stops below 1.1.2-6, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (4)

x_refsource_CONFIRM
Source: cverecord
https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6
x_refsource_MISC
Source: cverecord
https://github.com/openwrt/luci/pull/8710
x_refsource_MISC
Source: cverecord
https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f
x_refsource_MISC
Source: cverecord
https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829

SSVC — Action Prioritization

SSVCPoCNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.8HIGHGitHub_M
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-78

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card