CVE-2026-58000: luci-proto-openvpn Command Injection Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-58000 is a command injection flaw in the luci-proto-openvpn generateKey ubus method. The cl_meta parameter is passed unsanitized into a shell command executed via popen, enabling OS command injection. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability was fixed in commit e4ff45e. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network accessibility, low complexity, low privilege requirements, and high impact across confidentiality, integrity, and availability.

Business impact

An authenticated attacker exploiting this vulnerability can achieve remote code execution as root on systems running vulnerable luci-proto-openvpn versions. This enables complete system compromise, including data exfiltration, malware installation, lateral movement, and denial of service. Organizations relying on OpenVPN configuration through LuCI are at risk of infrastructure compromise if administrative credentials are exposed or if internal threat actors have LuCI access.

Affected systems

luci-proto-openvpn versions through 0.11.1 are vulnerable. The vulnerability requires the user to have authenticated LuCI access with OpenVPN protocol configuration privileges. Systems running OpenWrt or similar Linux distributions with LuCI and luci-proto-openvpn installed are affected. End-of-life or unsupported versions without patch availability may remain vulnerable.

Exploitability

This vulnerability has a low barrier to exploitation for authenticated users. An attacker with valid LuCI credentials can craft a malicious cl_meta parameter containing shell metacharacters (e.g., backticks, pipes, semicolons) to inject arbitrary commands. No user interaction is required beyond submitting the crafted request. Network accessibility and the requirement for prior authentication prevent opportunistic mass exploitation, but the vulnerability is trivial to weaponize once credentials are obtained.

Remediation

Upgrade luci-proto-openvpn to a version incorporating the fix from commit e4ff45e or later. Verify the specific patched version number in your vendor's release notes or advisory. Until patching is possible, restrict LuCI access to trusted users and networks, implement network segmentation to limit exposure of OpenVPN configuration interfaces, and monitor for suspicious parameter values in OpenVPN configuration logs.

Patch guidance

Determine your current luci-proto-openvpn version. Consult your distribution's package repository or vendor advisory to identify the fixed version that includes commit e4ff45e. Apply the update through your standard package management tools (opkg, apt, or equivalent). Verify the update by confirming the new version is active and by testing OpenVPN configuration functionality post-deployment. Organizations should prioritize patching systems with external network exposure or those handling sensitive VPN configurations.

Detection guidance

Monitor LuCI access logs and ubus method calls for requests to the generateKey method with suspicious cl_meta parameter values containing shell metacharacters or command substitution patterns. Look for unusual process spawning or privilege escalation events following OpenVPN configuration changes. Network-based detection should flag HTTP requests to LuCI endpoints with encoded shell syntax (e.g., %24, %28, %29, %7C) in parameters. Endpoint detection and response tools should alert on unexpected child processes spawned from OpenVPN or LuCI daemons with elevated privileges.

Why prioritize this

Despite the authenticated requirement, this vulnerability merits immediate prioritization due to its high CVSS score (8.8), exploitation simplicity, and potential for root-level code execution. Compromise of a VPN gateway or router running luci-proto-openvpn could enable widespread infrastructure access and lateral movement. The fix is available and integration is straightforward, making remediation a low-friction, high-impact action.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network-accessible attack vector, low attack complexity, and complete compromise of system confidentiality, integrity, and availability. The score is appropriately elevated despite the authentication requirement because LuCI access is often more widely distributed than other privileged interfaces, and compromised or shared credentials are common in real-world environments. The absence of user interaction and the direct path to root execution justify the high severity classification.

Frequently asked questions