The vulnerability arises from a permissive read ACL in luci-app-advanced-reboot that authorizes rpcd to execute the system shell /bin/sh. An attacker who gains a delegated session with this read ACL can supply arbitrary command parameters; rpcd validates the executable path and forwards the arguments to the shell, allowing any command to run as the root user. This flaw is classified as CWE-78 and results in unrestricted command execution, compromising confidentiality, integrity, and availability of the affected device.

The affected product is OpenWrt’s luci-app-advanced-reboot before version 1.1.2-6. Systems running 1.1.2-5 or earlier are vulnerable, while builds that omit the /bin/sh exec grant, such as the openwrt-24.10 and openwrt-23.05 branches, are not impacted. The weakness exists in the web interface’s ACL configuration for authenticated delegated users.

The CVSS score of 8.8 indicates a high severity of the flaw. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to obtain a delegated session that has the vulnerable read ACL on the router’s web interface; once achieved the attacker can run arbitrary commands as root with web‑initiated calls.