An improper privilege management flaw in the OpenWrt LuCI Samba application allows authenticated users to achieve remote code execution on the underlying system.

This is an improper privilege management vulnerability (CWE-269). Authenticated users with delegated permissions can manipulate the Samba daemon execution parameters, which leads to arbitrary command execution with elevated privileges.

With a CVSS score of 8.8, this vulnerability represents a severe threat to the integrity and confidentiality of the affected device. Successful exploitation allows an authenticated attacker to execute code as the user running the Samba daemon, potentially gaining full control over the router or appliance and facilitating lateral movement within the network.

Immediate Action: Update the luci-app-samba4 component to the latest available version provided by OpenWrt.

Proactive Monitoring: Review system logs for unusual process execution patterns or modifications to Samba configuration files that may indicate exploitation attempts.

Compensating Controls: Disable the Samba application if it is not strictly required for business operations, and enforce strict network access controls to ensure that only authorized users can access the LuCI management interface.

Public Exploit Available: Yes — a proof-of-concept exists per CISA's SSVC assessment.

Due to the existence of a proof-of-concept and the high-severity nature of remote code execution, this update should be applied as soon as a stable patch is available. Organizations should verify that their management interfaces are not exposed to the public internet to minimize the attack surface.