luci‑app‑banip uses an awk‑based routine that extracts the first IPv4 address it encounters in a log line, ignoring the field position. This string handling flaw (CWE‑116) permits an attacker to place an arbitrary IP address in a user‑supplied field such as the login username. When this login data is processed, the parser interprets the attacker‑supplied IP as the target to block. The result is that the intended network resource is not protected while the attacker’s own address remains open, effectively subverting the router’s firewall. The flaw can lead to unauthorized network access and denial of the legitimate target’s web presence.

The vulnerability resides in the OpenWrt package luci-app-banip. Version information for the affected releases is not supplied in the CVE data.; any deployment of this package where the log‑extraction feature is enabled is potentially impacted.

The CVSS score of 8.7 indicates a high severity flaw. The EPSS score of less than 1% suggests that exploit attempts are very rare, yet the vulnerability remains exploitable by an uneuthenticated remote attacker who can inject IP addresses through the web interface. Since the vulnerability is not listed in the CISA KEV catalog, no widespread exploit campaigns have been identified yet, but the impact of a successful attempt—permanent incorrect blocking of legitimate hosts—is significant. The attack vector is inferred to be remote through the web UI, requiring no authenticated access.