CVE-2026-62184: luci-app-banip Log Parsing RCE Vulnerability

CVE-2026-62184 Overview

CVE-2026-62184 is a log parsing vulnerability in luci-app-banip, the LuCI web interface for the banIP package on OpenWrt. The awk-based log parser extracts the first IPv4 address it encounters on a log line, regardless of which field contains it. An unauthenticated remote attacker can inject an arbitrary IP address into an attacker-controlled field such as a login username. When banIP processes the log line, it blocks the injected IP instead of the actual source, enabling denial of service against arbitrary targets while allowing the real attacker to remain unblocked. The vulnerability is classified under CWE-116 (Improper Encoding or Escaping of Output).

Critical Impact
An unauthenticated attacker can weaponize banIP to blocklist arbitrary IPv4 addresses, including trusted infrastructure or administrative networks, while evading the intended blocking action.

Affected Products

OpenWrt luci-app-banip versions prior to 1.8.10
OpenWrt LuCI web interface deployments using banIP log monitoring
Systems configured with ban_logterm regular expressions that match user-controlled log fields

Discovery Timeline

2026-07-13 - CVE-2026-62184 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62184

Vulnerability Analysis

The banIP package monitors system logs for authentication failures and other suspicious activity, then adds the offending source IP to a blocklist. The log monitor uses an awk-based parser that scans each matched log line for the first IPv4 address and extracts it as the ban target. This parser does not anchor extraction to a specific field position, such as the source-address field emitted by services like dropbear or sshd.

When a service logs an unsuccessful login attempt, some daemons include the supplied username in the log message. If the attacker sets the username to a valid IPv4 address, that string appears before the true source IP in the log line. The awk pattern matches the injected value first and passes it to banIP as the address to block.

Root Cause

The root cause is improper output neutralization in the log parsing logic [CWE-116]. The parser treats untrusted log content as structured data without validating field position or origin. Any log field an attacker can influence, including protocol-level fields like usernames, becomes a vector for controlling the extracted IP.

Attack Vector

An unauthenticated attacker connects to a network service monitored by banIP, such as SSH or the LuCI login page. The attacker submits a login attempt using a valid IPv4 address as the username, choosing an address they wish to deny service to. The failed authentication is written to the system log with the attacker-controlled username appearing before the real source address. banIP's log monitor extracts the injected IP and adds it to the firewall blocklist, denying that address rather than the attacker.

text

// Patch metadata from the fixed release
 LUCI_TITLE:=LuCI support for banIP
 LUCI_DEPENDS:=+luci-base +banip

-PKG_VERSION:=1.8.9
+PKG_VERSION:=1.8.10
 PKG_RELEASE:=1
 PKG_LICENSE:=Apache-2.0
 PKG_MAINTAINER:=Dirk Brenken <dev@brenken.org>

Source: GitHub commit d9bbc372e29618a8807b693a1ccf6d0e42cd196c

Detection Methods for CVE-2026-62184

Indicators of Compromise

Unexpected IPv4 addresses appearing in the banIP blocklist that correspond to legitimate infrastructure or administrator networks.
Authentication log entries containing IPv4-formatted usernames, such as Exit before auth from <IP> where the username field is itself an IP string.
Sudden loss of connectivity from previously trusted hosts shortly after failed login events on the OpenWrt device.

Detection Strategies

Review /var/log/messages and dropbear, sshd, or LuCI logs for failed authentication entries where the username field is a well-formed IPv4 address.
Correlate banIP blocklist additions with the originating log line and verify the extracted IP matches the true source address of the connection.
Alert on any banIP block action targeting internal, management, or partner IP ranges that should never appear on the blocklist.

Monitoring Recommendations

Forward OpenWrt system logs to a centralized log platform and apply parsing that distinguishes source-IP fields from user-supplied fields.
Monitor changes to banIP-managed nftables sets and generate alerts when new entries do not match a corresponding attacker source address in the raw log record.
Track the version of luci-app-banip installed across managed OpenWrt devices to confirm patched builds are in use.

How to Mitigate CVE-2026-62184

Immediate Actions Required

Upgrade luci-app-banip to version 1.8.10-1 or later, which corrects the log term handling and documents the first: prefix for source-first log formats.
Audit the current banIP blocklist and remove any entries that were injected via crafted usernames or other attacker-influenced log fields.
Restrict exposure of SSH, dropbear, and LuCI login interfaces to trusted networks until the patched package is deployed.

Patch Information

The fix is delivered in luci-app-banip release 1.8.10-1 via commit d9bbc372e29618a8807b693a1ccf6d0e42cd196c. The patched release updates the log term extraction logic to use the last IP per line by default and introduces a first: prefix for log formats where the source IP appears first, such as nginx. Refer to the GitHub Security Advisory GHSA-r6hx-4f83-vp8m and the VulnCheck Advisory for advisory details.

Workarounds

Disable the banIP log monitor feature until the patched package can be installed if immediate upgrade is not possible.
Remove or narrow ban_logterm regular expressions that match log lines containing user-supplied fields such as usernames.
Configure upstream services to omit or sanitize the supplied username in failed-authentication log messages where feasible.

bash

# Configuration example: update package and verify installed version on OpenWrt
opkg update
opkg upgrade luci-app-banip
opkg list-installed | grep luci-app-banip
# Expected output: luci-app-banip - 1.8.10-1 (or later)

# After upgrade, review the log term configuration
uci show banip | grep ban_logterm
# For source-first formats such as nginx, prefix the term with 'first:'