PT-2026-57886 · Unknown · Luci-App-Banip

Lujie · Published 2026-07-13 · Updated 2026-07-14 · CVE-2026-62184

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions luci-app-banip versions 0 through 0.11.1

Description A log parsing flaw exists where the awk-based parser extracts the first IPv4 address from log lines regardless of its field position. This allows an unauthenticated remote attacker to inject an arbitrary IP address through attacker-controlled fields, such as the login username field. Consequently, the system may block an incorrect target while the actual attacker remains unblocked.

Recommendations Update luci-app-banip to a version later than 0.11.1.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2026-62184

Affected Products

Luci-App-Banip

References · 5

• https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m · Vendor Advisory
• https://github.com/openwrt/luci/commit/d9bbc372e29618a8807b693a1ccf6d0e42cd196c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-62184 · Security Note
• https://twitter.com/f1tym1/status/2076867890800693426 · Twitter Post
• https://vulncheck.com/advisories/luci-app-banip-log-monitor-ip-extraction-bypass · Note