An authenticated command injection vulnerability in the OpenWrt LuCI advanced reboot application allows unauthorized users to execute arbitrary commands as root, posing a critical risk to network security.

This is an OS Command Injection vulnerability (CWE-78) where an overly permissive access control list grants the rpcd service permission to execute /bin/sh. An authenticated attacker can supply malicious parameters through the web interface to bypass restrictions and gain full root-level control over the device.

The ability to execute arbitrary commands as root allows an attacker to take full control of the affected networking hardware. This leads to potential data exfiltration, lateral movement within the local network, and complete system compromise. Given the CVSS score of 8.8, this high-severity vulnerability represents a significant threat to internal infrastructure integrity.

Immediate Action: Update the luci-app-advanced-reboot package to version 1.1.2-6 or later across all managed OpenWrt devices.

Proactive Monitoring: Review system logs for unusual process execution or shell activity originating from the LuCI web interface.

Compensating Controls: Restrict access to the LuCI web interface to trusted management IP addresses only, and minimize the number of accounts with delegated administrative sessions.

Public Exploit Available: Unknown.

The vulnerability poses a severe risk to network availability and security by granting attackers root access. Administrators should prioritize patching the affected LuCI application immediately to eliminate the command injection vector. If patching is not immediately feasible, restrict management interface access as a temporary measure to contain the threat.