Skip to main content
IMMUNITYSEC

CVE-2026-46368

luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

8.8
HIGH
CVSS 3.1
EPSS 7.8% · 95th pctCWE-77
2026-05-26•Updated 2026-07-14

Description

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.

Severity

CVSS 4.0 · CNA8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1 · CNA8.8 HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationpoc
Automatableno
Technical impacttotal

Affected Products

VendorProductAffected versions
mossdef-orgluci-app-https-dns-proxy
0 to 2025.12.29-5

References

3 Links
Exploits & PoCs

Record Details

Published
2026-05-26
Last updated
2026-07-14
Assigner (CNA)
VulnCheck
Credited to
Ahmet Mersin

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.