An authenticated path traversal vulnerability in OpenWrt luci-app-openvpn allows attackers to achieve persistent root code execution on the underlying system.

The luci-app-openvpn package fails to validate the instance_name2 parameter during file upload operations. This allows an authenticated user to perform path traversal, facilitating the placement of malicious files such as SSH keys in sensitive system directories.

Successful exploitation permits an authenticated attacker to gain persistent root access to the device. With a CVSS score of 9.9, the impact is catastrophic, potentially leading to full system takeover, network interception, and the compromise of all traffic passing through the affected router or gateway.

Immediate Action: Update the luci-app-openvpn package to the latest version provided by the OpenWrt project.

Proactive Monitoring: Monitor system logs for unauthorized file writes or unexpected modifications to sensitive configuration directories like /etc/ or /root/.

Compensating Controls: Restrict access to the LuCI web interface to trusted management networks only, and ensure that only highly privileged, audited users have access to the administrative dashboard.

Public Exploit Available: No

Administrators must prioritize updating the luci-app-openvpn package to the version that includes the necessary path validation fixes. Because this vulnerability allows for persistent root access, immediate remediation is essential to maintain the integrity of the network infrastructure.