OpenWrt LuCI’s luci-mod-system-mounts module implements an overly permissive ACL that permits users belonging to the mount‑configuration group to write arbitrary entries to /etc/crontabs/root using ubus file.write. The default busybox crond daemon executes any cron jobs stored in that file as root within a minute, thereby allowing an authenticated user with only mount‑configuration privileges to execute arbitrary code on the system.

The vulnerability affects OpenWrt LuCI, specifically the luci-mod-system-mounts component. No specific version numbers are listed in the advisory, so all releases that include the present ACL logic are potentially impacted.

The CVSS score of 8.7 indicates a high level of severity, while the EPSS score is not provided and the issue is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user within the mount‑configuration ACL group exploiting the ubus file.write interface to inject cron entries, which are then executed automatically by crond as root. The exploitation does not require additional privileges beyond the described ACL membership, making it readily actionable for any attacker who obtains such access.