CVE-2026-46368

luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

Published May 26, 2026 CVSS 4.0 · 8.7 High EPSS 6.6% KEV · Not listed

Description

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.

Analysis

Technical impact

The vulnerability is a command injection flaw in the setInitAction function of the luci-app-https-dns-proxy add‑on. An authenticated user who holds the luci.https-dns-proxy ACL permission can supply shell metacharacters through the 'name' parameter of a ubus RPC call, causing arbitrary command execution with root privileges on the device.

Affected Systems

Affected are installations of mossdef-org:luci-app-https-dns-proxy through version 2025.12.29‑5 on OpenWrt routers. The package is optional and not installed by default; only devices that have added the LuCI web package are vulnerable.

Risk and Exploitability

The CVSS score of 8.7 marks high severity. The EPSS score of 7% indicates a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The description does not state whether the ubus RPC interface is reachable externally, so remote exploitation is inferred rather than confirmed. If the interface is network‑reachable, the attack can be carried out remotely; otherwise it remains code execution locally.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mossdef-org

luci-app-https-dns-proxy

affected

Version	Status	Constraints
`0`	affected	≤ 2025.12.29-5

No data.

Vendor Product Versions

Mossdef-org

Luci-app-https-dns-proxy

Version	Status	Scheme	Platform
`[0,2025.12.29-5]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest official update for luci-app‑https‑dns‑proxy from the OpenWrt community package feed to eliminate the command injection flaw.
If the package is not needed for your service, uninstall or disable luci-app‑https‑dns‑proxy to remove the attack surface.
Restrict the luci.https-dns-proxy ACL so that only trusted local users have permission to invoke the setInitAction function.
Block external access to the LuCI web interface and ubus RPC endpoint with firewall rules, ensuring the interface is only reachable from trusted internal networks.

Generated by OpenCVE AI on October 25, 2026 at 19:02 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 6.6% (6.582% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/stangri/luci-app-https-dns-proxy
https://www.exploit-db.com/exploits/52521
https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-authenticated-command-injection-via-setinitaction

History

Jul 14, 2026 9:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mossdef Mossdef luci-app-https-dns-proxy
CPEs		cpe:2.3:a:mossdef:luci-app-https-dns-proxy::::::::
Vendors & Products		Mossdef Mossdef luci-app-https-dns-proxy

May 27, 2026 10:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mossdef-org Mossdef-org luci-app-https-dns-proxy
Vendors & Products		Mossdef-org Mossdef-org luci-app-https-dns-proxy

May 26, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 26, 2026 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.
Title		luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
Weaknesses		CWE-77
References		https://github.com/stangri/luci-app-https-dns-proxy https://www.exploit-db.com/exploits/52521 https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-authenticated-command-injection-via-setinitaction
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`