PT-2026-26432 · Openwrt · Openwrt

Axelm-Tob · Published 2026-03-19 · Updated 2026-03-20 · CVE-2026-30874

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 24.10.6

Description OpenWrt Project is a Linux operating system designed for embedded devices. A flaw exists in the hotplug call function that allows an attacker to circumvent environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is designed to filter sensitive environment variables, such as PATH, when executing hotplug scripts in /etc/hotplug.d. However, a bug using strcmp instead of strncmp causes the filter to incorrectly compare the full environment string against the literal "PATH", resulting in the PATH variable not being excluded. This allows an attacker to control the binaries executed by scripts invoked by procd running with elevated privileges. The vulnerable function is hotplug call. The vulnerable parameter is PATH.

Recommendations Update to version 24.10.6 or later.

Exploit

Fix

Improper Privilege Management

Special Elements Injection

Weakness Enumeration

CWE-269

CWE-187

CWE-74

Related Identifiers

CVE-2026-30874

GHSA-JW28-HXCM-J934

Affected Products

Openwrt

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30874.json · Exploit
• https://github.com/openwrt/openwrt/security/advisories/GHSA-jw28-hxcm-j934 · Vendor Advisory
• https://github.com/openwrt/procd/commit/e08cdc8562f55b9ac228a21f3f7605a18c522b81 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-30874 · Security Note
• https://osv.dev/vulnerability/CVE-2026-30874 · Vendor Advisory
• https://twitter.com/CVEnew/status/2034841524266222009 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034842847682191498 · Twitter Post