Security readout for executives and security teams
Plain-English summary
This affects an optional OpenWrt LuCI add-on for DNS-over-HTTPS proxy management, not core OpenWrt by default. A logged-in user with the specific add-on permission could make the device run arbitrary commands as root. That can mean full device takeover where the package is installed.
Executive priority
Treat as high priority for exposed or shared-admin OpenWrt devices. It can become root-level device compromise, but only where the optional add-on is installed and an attacker has the required authenticated permission.
Technical view
luci-app-https-dns-proxy through 2025.12.29-5 has CWE-77 command injection in setInitAction. The vulnerable ubus RPC path accepts a crafted name parameter from an authenticated user with luci.https-dns-proxy ACL permission, leading to root command execution on the device.
Likely exposure
Exposure is limited to OpenWrt systems that opted into luci-app-https-dns-proxy from the community packages feed. The source states core OpenWrt is not affected and the package is not installed by default. Risk rises where LuCI administration is broadly reachable or delegated users have the add-on ACL.
Exploitation context
The CVE is not listed as KEV in the provided bundle, so active exploitation is not established here. A public ExploitDB reference is listed, indicating exploit information exists. Exploitation still requires valid authentication with the relevant luci.https-dns-proxy permission.
Researcher notes
Evidence supports authenticated root command execution via setInitAction in luci-app-https-dns-proxy. The bundle does not provide a confirmed fixed version or active exploitation evidence. Avoid broad OpenWrt impact claims; scope is the optional LuCI add-on only.
Mitigation direction
- Identify and remove luci-app-https-dns-proxy where it is not operationally required.
- Check the official project and OpenWrt package guidance for fixed versions or maintainer instructions.
- Restrict LuCI administrative access to trusted management networks only.
- Remove luci.https-dns-proxy ACL permission from users who do not need it.
- Investigate and rebuild devices where unauthorized privileged access is suspected.
Validation and detection
- Inventory OpenWrt devices for installed luci-app-https-dns-proxy packages.
- Confirm whether installed versions are through 2025.12.29-5.
- Review LuCI users and roles for luci.https-dns-proxy ACL permission.
- Check whether LuCI or ubus management paths are exposed beyond trusted networks.
- Review device logs for unexpected add-on configuration or privileged activity.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-46368 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-52521CVE reference, VulnCheck · exploit
- Official Product HomepageCVE reference, VulnCheck · product
- VulnCheck Advisory: luci-app-https-dns-proxy Authenticated Command Injection via setInitActionCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.