An OS command injection vulnerability in OpenWrt LuCI permits authenticated attackers to achieve remote code execution on the underlying system.

This vulnerability involves an improper neutralization of special elements used in an OS command (CWE-78). The flaw exists within the luci-app-dockerman component and requires the attacker to hold low-level authenticated access to the interface to trigger the injection.

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the LuCI process. This could lead to a complete system compromise, unauthorized data access, or the deployment of persistent backdoors on the networking device. Given the CVSS score of 8.8, this represents a significant risk to network infrastructure integrity.

Immediate Action: Update the luci-app-dockerman package to the version provided in the official OpenWrt security advisory.

Proactive Monitoring: Review system and application logs for unusual shell command executions or unexpected process spawning originating from the LuCI web interface.

Compensating Controls: Restrict administrative access to the LuCI interface to trusted management networks only to minimize the attack surface.

Public Exploit Available: No confirmed public exploit (e.g., Metasploit or ExploitDB) is identified in the provided data.

The high CVSS score reflects the severity of potential remote code execution on networking equipment. Administrators must prioritize applying the vendor-supplied patch to prevent unauthorized system control.