Ahmet Mersin

**Name of the Vulnerable Software and Affected Versions** luci-app-https-dns-proxy versions prior to 2025.12.29-5 **Description** An authenticated user with the `luci.https-dns-proxy` ACL permission can execute arbitrary commands as root on the underlying device. This occurs through a command injection in the `setInitAction()` function, where shell metacharacters can be injected via the `name` parameter of a ubus RPC call to 'luci.https-dns-proxy setInitAction'. This issue affects the optional LuCI web UI add-on for the https-dns-proxy package distributed through the OpenWrt community packages feed; core OpenWrt is not affected. **Recommendations** Update to a version later than 2025.12.29-5. As a temporary workaround, restrict access to the `setInitAction()` function or the `name` parameter in the 'luci.https-dns-proxy setInitAction' ubus RPC call.

Name of the Vulnerable Software and Affected Versions: Huawei HG255s-10 version V100R001C163B025SP02 Description: The issue is due to insufficient validation of received HTTP requests, allowing a remote attacker to access local files on the device without authentication. This is a result of a path traversal vulnerability. Recommendations: For Huawei HG255s-10 version V100R001C163B025SP02, consider restricting access to the device until a patch is available, and avoid using HTTP requests that could potentially exploit the path traversal vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.