CVE-2026-55897

Description

luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 8.8 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 8.8 / 10 HIGH source: CNA overview
CWE(s): CWE-78
Reserved: 2026-06-17
Published: 2026-09-21 19:29 UTC
Last updated: 2026-09-21 20:06 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/55xxx/CVE-2026-55897.json
Linked Threat: CVE-2026-55897 — luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-21 20:17:26 UTC
NVD last modified: 2026-09-21 21:17:05 UTC
NVD CVSS v3.1: 8.8 / 10 HIGH source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore: 2.8 / 10
Impact subscore: 5.9 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84101
Assigner: GitHub_M
Published: Sep 21, 2026, 7:29:37 PM
Updated: Sep 21, 2026, 8:06:41 PM
EUVD base score (CVSS 3.1): 8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EUVD-reported EPSS: 0.0000
Vendors: OpenWRT
Products: luci (< 1.1.2-6)

ENISA description: luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.

EUVD references (4)

Affected products (1)

Vendor	Product	Versions	Platforms
openwrt	luci	`< 1.1.2-6` (affected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6 x_refsource_CONFIRM
https://github.com/openwrt/luci/pull/8710 x_refsource_MISC
https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f x_refsource_MISC
https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f security-advisories@github.com
https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829 security-advisories@github.com
https://github.com/openwrt/luci/pull/8710 security-advisories@github.com
https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6 security-advisories@github.com
https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6 134c704f-9b21-4f2e-91b3-4a467353bcc0

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE

web:docs.oracle.com

Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE Services: Java Management Release Date: August 18, 2026 Java Management supports the following releases that are part of the Oracle Security Critical Patch Update (CSPU) August 2026 for Oracle Java SE:

2026-09-22 16:48 UTC
Pennsylvania Access To Criminal History - Home - pa

web:epatch.pa.gov

Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...

2026-09-22 16:48 UTC
Patch - Everything Local: Breaking News, Events, Discussions

web:patch.com

The best breaking news, stories, and events from the Patch network of local news sites

2026-09-22 16:48 UTC
Joliet News, Breaking News in Joliet, IL - Patch

web:patch.com

Joliet Latest Headlines: 'After Devastating Motorcycle Collision,' Joliet Man Faces Unimaginable Road To Recovery: GoFundMe ; VIDEO: Startled Joliet Police Officer Finds Man, 37, Hiding Under Pool ...

2026-09-22 16:48 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-09-22 16:48 UTC
Home - The Patch Augusta Municipal Golf Course

web:www.golfthepatch.com

Now open, The Patch features a redesigned 18-hole course, led by golf course architects Tom Fazio and Beau Welling, and a new 9-hole short course, The Loop at The Patch , designed by Tiger Woods and TGR Design. Welcome to Augusta's best-in-class public golf experience.

2026-09-22 16:48 UTC
Oracle

web:www.oracle.com

Oracle Critical Security Patch Update Advisory - August 2026 Description. A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, mor

2026-09-22 16:48 UTC
Home - PATCH Hawaii

web:www.patchhawaii.org

PATCH provides access to registered and licensed child care, offers child care subsidies to eligible families, provides child development training and ECE scholarship opportunities, and assists those interested in starting a family child care business. PATCH is a free resource hub for families, child care professionals and communities of Hawaii.

2026-09-22 16:48 UTC
Careers - PATCH Hawaii

web:www.patchhawaii.org

CAREERS & Employment Opportunities Click below to jump to the section you are looking for. PATCH Jobs ECE Jobs PATCH Jobs Early Learning Data Analyst (Independent Contractor) View Job Post Child Care Food Program Manager View Job Post Kona Child Care Trainer (on-call) View Job Post Hilo Child Care Trainer (on-call) View Job Post Kauai

2026-09-22 16:48 UTC
Rom Patcher JS

web:www.romhacking.net

An online web-based ROM patcher. Supported formats: IPS, BPS, UPS, APS, RUP, PPF and xdelta.

2026-09-22 16:48 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-55897.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55897",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T20:05:24.106310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T20:06:41.423Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "luci",
          "vendor": "openwrt",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.1.2-6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a  way to reboot your router into an alternative firmware partition or perform  reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T19:29:37.003Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/openwrt/luci/security/advisories/GHSA-vj96-f37g-37f6"
        },
        {
          "name": "https://github.com/openwrt/luci/pull/8710",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openwrt/luci/pull/8710"
        },
        {
          "name": "https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openwrt/luci/commit/2df00deb122093cbf429266ffef7ad06aaecb48f"
        },
        {
          "name": "https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openwrt/luci/commit/f85102548ee8325bfd581a0327b210b5f7670829"
        }
      ],
      "source": {
        "advisory": "GHSA-vj96-f37g-37f6",
        "discovery": "UNKNOWN"
      },
      "title": "luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55897",
    "datePublished": "2026-09-21T19:29:37.003Z",
    "dateReserved": "2026-06-17T16:59:42.760Z",
    "dateUpdated": "2026-09-21T20:06:41.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}