An authenticated remote code execution vulnerability in OpenWrt luci-app-adblock-fast poses a severe risk to system integrity by allowing attackers to gain full root-level control.

This vulnerability is a CRLF injection flaw within the luci.adblock-fast.setCronEntry RPC method. An authenticated user with specific write ACLs can inject newline characters to create unauthorized entries in the root crontab, leading to persistent command execution as UID 0.

The ability to execute arbitrary commands as the root user grants an attacker complete control over the affected device. This could lead to full system compromise, data theft, or the use of the device as a pivot point within the local network. Given the CVSS score of 8.8, this flaw represents a significant threat to operational security and service availability.

Immediate Action: Update the luci-app-adblock-fast package to version 1.2.4-2 or later as provided by the official OpenWrt package repositories.

Proactive Monitoring: Review system crontabs for unauthorized entries and monitor access logs for suspicious activity involving the luci-app-adblock-fast RPC endpoints.

Compensating Controls: Restrict administrative access to the WebUI and ensure that only trusted, authorized users are granted write ACLs for the adblock-fast component.

Public Exploit Available: Unknown

Organizations utilizing OpenWrt with the luci-app-adblock-fast package should prioritize updating to version 1.2.4-2 immediately. While the vulnerability requires authentication, the potential for persistent root-level command execution necessitates rapid remediation to prevent long-term system compromise.