Technical impact
The flaw resides in OpenWrt’s cgi-download handler, which validates the requested path against the caller’s ubus session file ACL before performing canonicalization. The lack of path normalisation allows an attacker to specify a path that matches an authorised wildcard prefix followed by "/../", enabling traversal into directories containing system files. An attacker can therefore read any root‑readable file such as "/etc/shadow", obtaining sensitive credentials. This constitutes a remote file read vulnerability.
Affected Systems
The vulnerability applies to all OpenWrt releases before version 25.12.5. Any device running an affected OpenWrt firmware that exposes the cgi-io download interface is at risk. The vendor does not list specific model or patch level variants beyond the excluded 25.12.5 release.
Risk and Exploitability
The CVSS score is 4.9, indicating a moderate impact with limited privileges needed; the EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is initiating an HTTP request to the vulnerable cgi-download endpoint from an unauthorised client, assuming network exposure of the interface. No additional exploitation conditions are described beyond the path traversal privilege issue.
