CVE-2026-55897: OpenWrt luci-app-advanced-reboot RCE Vulnerability

CVE-2026-55897 Overview

CVE-2026-55897 is a command injection vulnerability [CWE-78] in luci-app-advanced-reboot, a LuCI web interface application for OpenWrt that reboots routers into alternative firmware partitions. The read Access Control List (ACL) at applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd the file.exec permission for the general shell interpreter /bin/sh. An authenticated session with the read ACL can supply caller-controlled arguments, which rpcd passes to the shell. This chain enables arbitrary command execution as root on affected devices.

Critical Impact
An authenticated attacker with a delegated read session can execute arbitrary commands as root on affected OpenWrt routers, achieving full device compromise.

Affected Products

OpenWrt luci-app-advanced-reboot versions prior to 1.1.2-6
Builds that include the /bin/sh exec grant in the rpcd ACL
Note: openwrt-24.10 and openwrt-23.05 branch builds without the /bin/sh exec grant are not affected by this specific chain

Discovery Timeline

2026-09-21 - CVE-2026-55897 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-55897

Vulnerability Analysis

The flaw resides in the ACL configuration shipped with luci-app-advanced-reboot. The JSON ACL file grants the rpcd daemon permission to invoke /bin/sh through the file.exec method. Because /bin/sh is a general-purpose shell interpreter, any argument passed to it is interpreted as a shell command. The rpcd authorization layer verifies only the executable path, not the argument content. Any authenticated LuCI user whose delegated session inherits this read ACL can therefore drive shell execution through the rpcd interface.

Root Cause

The root cause is an overly permissive file.exec ACL entry that whitelists a shell interpreter rather than a specific, bounded utility. Granting file.exec on /bin/sh collapses the distinction between reading state and running arbitrary code. Fine-grained rpcd ACLs are intended to restrict callable binaries to safe, purpose-built helpers, and this rule violated that principle.

Attack Vector

An attacker with valid credentials for a delegated LuCI session issues a ubus/rpcd call to the file.exec method, specifying /bin/sh as the executable and supplying command strings through the params array. rpcd passes those arguments directly to the shell, and the shell executes them with root privileges. The vulnerability requires network access to the LuCI interface and low-privilege authentication.

text

# Patch bumps package version to the fixed release
 PKG_NAME:=luci-app-advanced-reboot
 PKG_LICENSE:=AGPL-3.0-or-later
 PKG_MAINTAINER:=Stan Grishin <stangri@melmac.ca>
-PKG_VERSION:=1.1.1
-PKG_RELEASE:=15
-
-PKG_BUILD_DEPENDS:=jq/host
+PKG_VERSION:=1.1.2
+PKG_RELEASE:=6

Source: GitHub Commit 2df00de

Detection Methods for CVE-2026-55897

Indicators of Compromise

Unexpected rpcd invocations of /bin/sh via the file.exec ubus method in system logs
New or modified files under /etc/, /tmp/, or /root/ following a LuCI session
Outbound connections from the router to unfamiliar hosts shortly after LuCI authentication
Presence of luci-app-advanced-reboot at version below 1.1.2-6 alongside a rpcd ACL granting file.exec on /bin/sh

Detection Strategies

Audit /usr/share/rpcd/acl.d/luci-app-advanced-reboot.json for file.exec entries referencing /bin/sh or other shell interpreters
Inspect logread output for rpcd calls executing shell commands not tied to legitimate reboot workflows
Correlate LuCI authentication events with subsequent process spawns of sh, ash, or busybox under the rpcd parent

Monitoring Recommendations

Forward router syslog and rpcd logs to a central Security Information and Event Management (SIEM) platform for continuous review
Alert on any ubus call file exec request where the command argument resolves to /bin/sh or another interpreter
Track package inventory across the OpenWrt fleet to identify hosts still running vulnerable luci-app-advanced-reboot releases

How to Mitigate CVE-2026-55897

Immediate Actions Required

Upgrade luci-app-advanced-reboot to version 1.1.2-6 or later on all OpenWrt devices
Remove or restrict the file.exec grant on /bin/sh in the package ACL until the update is applied
Rotate credentials for any LuCI accounts that had access to the vulnerable interface
Restrict network access to the LuCI web interface to trusted management networks only

Patch Information

The vulnerability is fixed in luci-app-advanced-reboot1.1.2-6. The upstream fix is tracked in GitHub Pull Request #8710 and merged via commits 2df00de and f851025. Refer to the GitHub Security Advisory GHSA-vj96-f37g-37f6 for the full advisory.

Workarounds

Uninstall luci-app-advanced-reboot if the alternative-partition reboot feature is not required
Manually edit the ACL file to remove the /bin/sh entry from the file.exec list and restart rpcd
Bind the LuCI interface to a management VLAN and enforce firewall rules that block untrusted access

bash

# Update package lists and install the fixed release
opkg update
opkg install luci-app-advanced-reboot

# Verify installed version is 1.1.2-6 or later
opkg list-installed | grep luci-app-advanced-reboot

# Restart rpcd after ACL changes
/etc/init.d/rpcd restart