The vulnerability resides in the generateKey ubus method of luci. An authenticated LuCI user with OpenVPN configuration access can inject arbitrary shell metacharacters into the cl_meta parameter, which is interpolated directly into a shell command and executed with root privileges via popen. This results in full remote code execution, giving an attacker complete control over the host system.

The flaw affects the OpenWrt luci-proto-openvpn component up to and including version 0.11.1. Users of this package before the fix applied in commit e4ff45e are at risk.

With a CVSS score of 8.7, this issue is classified as high severity, though the EPSS score is 1% and it is not yet listed in CISA’s KEV catalog. The required conditions for exploitation are an authenticated session through the LuCI web interface with OpenVPN configuration rights, making the attack path local but achievable from the device’s management interface. The lack of input sanitization makes the vulnerability easy to exploit for anyone who can log into the web interface.