Description
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| openwrt | luci | ≤ 24.10.8, 25.12.0 – ≤ 25.12.5 | — |
References
- GitHub Security Advisory (GHSA-v5f9-62c7-cw29) vendor-advisory
- VulnCheck Advisory: OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write third-party-advisory