CVE-2026-46368

HIGH

luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-46368. PoCs published by Ahmet Mersin, iwallplace.

AI-analyzed exploit summary This exploit demonstrates an authenticated command injection vulnerability in OpenWrt's luci-app-https-dns-proxy, allowing a privileged user to escalate to root by injecting commands into the 'setInitAction' function via the 'name' parameter.

Description

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.

Exploits (2)

exploitdb WORKING POC
by Ahmet Mersin · pythonlocalmultiple
https://www.exploit-db.com/exploits/52521

This exploit demonstrates an authenticated command injection vulnerability in OpenWrt's luci-app-https-dns-proxy, allowing a privileged user to escalate to root by injecting commands into the 'setInitAction' function via the 'name' parameter.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: OpenWrt 23.05 with luci-app-https-dns-proxy (versions prior to 2026-01-17)
Auth required
Prerequisites: Authenticated user with 'setInitAction' permission in luci.https-dns-proxy ACL · Network access to the OpenWrt router
mistral-large-3 · analyzed May 26, 2026 Full analysis →
nomisec WORKING POC 1 stars
by iwallplace · poc
https://github.com/iwallplace/CVE-2026-46368-OpenWrt-Exploit

This repository contains a functional exploit for CVE-2026-46368, an authenticated command injection vulnerability in OpenWrt's luci-app-https-dns-proxy. The exploit leverages improper input sanitization in the setInitAction RPC method to execute arbitrary commands as root.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenWrt luci-app-https-dns-proxy (versions prior to 2026-01-17)
Auth required
Prerequisites: Authenticated access to OpenWrt LuCI interface · User with luci.https-dns-proxy ACL permission
mistral-large-3 · analyzed Jun 19, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit exploit
ExploitDB-52521
https://www.exploit-db.com/exploits/52521
Product product
Official Product Homepage
https://github.com/stangri/luci-app-https-dns-proxy
Third Party Advisory third-party-advisory
VulnCheck Advisory: luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
https://www.vulncheck.com/advisories/luci-app-https-dns-proxy-authenticated-command-injection-via-setinitaction

Scores

CVSS v3 8.8
EPSS 0.0658
EPSS Percentile 93.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-77
Status published
Products (1)
mossdef-org/luci-app-https-dns-proxy < 2025.12.29-5
Published May 26, 2026
Tracked Since May 26, 2026