CVE-2026-62947

MediumCVSS 4.9

Published: 15/07/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

28th percentile - higher than 28% of all known CVEs

Summary

OpenWrt prior to version 25.12.5 has a vulnerability in the cgi-download handler in cgi-io that allows reading root-readable files including /etc/shadow via path traversal using an allowed wildcard prefix followed by ../.

Risk Assessment

An unauthorized attacker can read sensitive system files, leading to leakage of passwords and other confidential data.

Recommendation

Upgrade OpenWrt to version 25.12.5 or later, which includes the fix for this vulnerability.

Other vulnerabilities in OpenWrt

CVE-2026-55490Medium
In OpenWrt before v25.12.5, an integer underflow in the handle_send_a() function of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The issue is fixed in v25.12.5.

Original NVD description (English source)

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS