CVE-2026-46368
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Command injection vulnerability in luci-app-https-dns-proxy for OpenWrt. An authenticated user with appropriate permissions can inject shell metacharacters via the 'name' parameter in a ubus RPC call, leading to arbitrary command execution as root.
Risk Assessment
An attacker with access to the LuCI panel can gain full control over the device by executing arbitrary system commands.
Recommendation
It is recommended to uninstall the luci-app-https-dns-proxy package if not essential, or apply available security patches.
Original NVD description (English source)
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.