CVE-2026-72840

EUVD-2026-58548
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.88%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
openwrtluci
𝑥
≤ 24.10.8
CNA
openwrtluci
25.12.0 ≤
𝑥
≤ 25.12.5
CNA
Common Weakness Enumeration
References
https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29
https://www.vulncheck.com/advisories/openwrt-luci-luci-mod-system-mounts-acl-root-rce-via-crontab-write
https://github.com/openwrt/luci/security/advisories/GHSA-v5f9-62c7-cw29