Description

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T22:17:23.640Z",
  "pubdate": "2026-08-13T22:17:23.640Z",
  "executiveSummary": "An overly permissive Access Control List (ACL) definition exists in the luci-mod-system-mounts component of OpenWrt LuCI, introducing a privilege escalation vulnerability.\nThe vulnerability allows authenticated users restricted to the mount-configuration ACL group to gain arbitrary code execution with root privileges.\nThe root cause stems from granting excessive write permissions to sensitive system files via the ubus file.write interface.\nAn attacker possessing valid authentication credentials restricted solely to mount configuration capabilities can exploit this flaw by appending arbitrary cron entries to the system crontab.\nThe default busybox crond daemon automatically executes these injected entries as the root user within a one-minute timeframe.\nThis represents a significant security risk, enabling low-privilege users to bypass intended authorization boundaries and achieve full administrative control over the underlying OpenWrt system.\nSuccessful exploitation requires prior authentication and access to the LuCI interface or ubus socket, but bypasses all intermediate privilege restrictions by abusing misconfigured access controls.",
  "technicalDetails": "The vulnerability resides in the Access Control List (ACL) configuration governing the luci-mod-system-mounts package within OpenWrt LuCI.\nThe affected component inappropriately maps mount-configuration privileges to include file write capabilities that extend beyond the intended scope of storage management.\nSpecifically, the ACL grants write access to the critical system file located at /etc/crontabs/root.\nThe attack flow leverages the ubus IPC (Inter-Process Communication) mechanism, specifically the file.write procedure exposed to authenticated sessions.\nAn attacker with credentials limited to the mount-configuration ACL group interacts with the ubus interface to target the /etc/crontabs/root file path.\nBy issuing a crafted file.write command through ubus, the attacker appends arbitrary cron job payloads directly into the root user's crontab file without triggering validation or sanitization checks regarding the destination file contents.\nThe payload behavior relies on the native system scheduling daemon, busybox crond, which periodically evaluates /etc/crontabs/root for scheduled tasks.\nWithin a maximum interval of one minute, the busybox crond daemon processes the newly appended cron entry and executes the attacker-supplied commands with full root privileges.\nThe post-exploitation impact is catastrophic, resulting in complete system compromise, arbitrary command execution as root, and potential persistence mechanisms established across reboots.\nThe requirements for exploitation include valid authentication credentials assigned to the mount-configuration ACL group, and network or local access to the ubus service or LuCI web interface."
}