The hotplug_call function in OpenWrt is designed to execute scripts in /etc/hotplug.d with elevated privileges, filtering out sensitive environment variables such as PATH. The bug uses strcmp instead of strncmp, causing the comparison to always fail and the PATH variable to remain unfiltered. An attacker can thus inject a custom PATH and control which binaries are executed by procd‑invoked scripts, leading to privilege escalation. This represents a classic string comparison flaw (CWE‑1025) and unauthorized privilege escalation (CWE‑269).

OpenWrt, the Linux operating system for embedded devices, is affected in all releases prior to 24.10.6. The vulnerability affects the core procd component and the hotplug mechanism used across the platform. Users running an older OpenWrt build should verify their version and consider an upgrade.

The CVSS score is 1.8, indicating a low severity, and the EPSS score is less than 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors require local access or the ability to place malicious content in /etc/hotplug.d, which is typically restricted. An attacker who can write hotplug scripts or alter environment variables would be able to execute arbitrary binaries with elevated privileges, but remote exploitation without local access is unlikely.