CVE-2026-55159

HighCVSS 8.8

Published: 21/09/2026(UTC)Updated: 29/09/2026(UTC)Translated: 22/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

40th percentile - higher than 40% of all known CVEs

Summary

luci-app-adblock-fast for OpenWrt prior to 1.2.4-2 allowed the luci.adblock-fast.setCronEntry RPC method to accept an entry argument containing carriage-return or line-feed characters and serialize it into /etc/crontabs/root as one logical line. An authenticated delegated user with the write ACL could create an additional root cron entry, resulting in persistent command execution as UID 0.

Risk Assessment

An authenticated user with write permission can achieve persistent command execution as root via cron, leading to full system compromise. The issue is not demonstrated for unauthenticated callers or users without the component write ACL.

Recommendation

Update luci-app-adblock-fast to version 1.2.4-2 or later. Restrict granting the component write ACL to trusted accounts.

Other vulnerabilities in luci-app-adblock-fast

CVE-2026-68583Medium
luci-app-adblock-fast before version 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field. Lower-privileged users can inject active HTML, which executes in the administrator's browser when viewing the AdBlock Fast status page, under the LuCI origin.

Original NVD description (English source)

luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS