A critical authorization bypass and path traversal vulnerability in the OpenWrt LuCI LXC application allows low-privileged users to achieve root code execution on the host system.

This vulnerability, classified as CWE-73, involves an ACL inconsistency that permits path traversal via the lxc_name parameter. By escaping container directories, an authenticated user with low privileges can trigger host-side scripts, resulting in root-level code execution on the OpenWrt host.

The CVSS score of 9.9 highlights the extreme danger of this flaw. By allowing a low-privileged user to escalate to root-level host control, the vulnerability enables complete compromise of the network device, which can be used to intercept traffic, modify configurations, or pivot into internal network segments.

Immediate Action: Update the OpenWrt LuCI installation to the latest version as specified in the official vendor security advisory.

Proactive Monitoring: Review LuCI access logs for suspicious input sequences, specifically searching for path traversal patterns like /.%2E.

Compensating Controls: Limit administrative access to the LuCI interface to trusted management networks and strictly enforce the principle of least privilege for all user accounts.

Public Exploit Available: No

Given the potential for root-level host execution, this vulnerability poses a severe threat to network integrity. Administrators should consult the OpenWrt security advisory immediately to identify the correct patched version and apply the update to all affected devices.