PT-2026-53683 · Openwrt · Luci

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-58000

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl meta to execute commands as root via the popen function.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-58000

Affected Products

Luci

References · 4

• 🔥 https://github.com/openwrt/luci/security/advisories/GHSA-pm9w-522m-8rrh · Exploit
• https://github.com/openwrt/luci/commit/e4ff45ecbc6ad212951815c8c99b2749fbd7de6b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58000 · Security Note
• https://vulncheck.com/advisories/luci-proto-openvpn-command-injection-via-cl-meta-parameter-in-generatekey · Note