Vulnerability in Openwrt Luci
CVE-2026-62184
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.008 (54.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Openwrt Luci — versions 0, d9bbc372e29618a8807b693a1ccf6d0e42cd196c
- Openwrt Luci-App-Banip — versions 0, d9bbc372e29618a8807b693a1ccf6d0e42cd196c
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-62184?
- CVE-2026-62184 is a high-severity vulnerability in Openwrt Luci, classified under Improper Encoding or Escaping of Output. CVSS score: 7.5/10. Published 2026-07-13.
- How severe is CVE-2026-62184?
- High severity. CVSS v3 base score is 7.5 out of 10.