CVE-2026-58000: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in openwrt luci-proto-openvpn
luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.
AI Analysis
Technical Summary
The luci-proto-openvpn package in openwrt versions up to 0.11.1 contains an OS command injection vulnerability in the generateKey ubus method. This occurs because the cl_meta parameter is interpolated directly into a shell command without proper escaping or quoting, allowing an authenticated user with OpenVPN configuration access to inject shell metacharacters. Exploitation results in arbitrary command execution with root privileges via the popen function. The vulnerability was addressed in a commit identified as e4ff45e, which fixes the improper neutralization of special elements.
Potential Impact
An authenticated user with access to OpenVPN protocol configuration in LuCI can execute arbitrary commands as root on the affected device. This can lead to full system compromise, unauthorized control, and potential disruption of network services.
Mitigation Recommendations
A fix for this vulnerability is available and was introduced in commit e4ff45e. Users should update luci-proto-openvpn to a version that includes this fix (versions later than 0.11.1). Until updated, restrict access to authenticated users with OpenVPN protocol configuration privileges to trusted personnel only.
CVE-2026-58000: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in openwrt luci-proto-openvpn
Description
luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The luci-proto-openvpn package in openwrt versions up to 0.11.1 contains an OS command injection vulnerability in the generateKey ubus method. This occurs because the cl_meta parameter is interpolated directly into a shell command without proper escaping or quoting, allowing an authenticated user with OpenVPN configuration access to inject shell metacharacters. Exploitation results in arbitrary command execution with root privileges via the popen function. The vulnerability was addressed in a commit identified as e4ff45e, which fixes the improper neutralization of special elements.
Potential Impact
An authenticated user with access to OpenVPN protocol configuration in LuCI can execute arbitrary commands as root on the affected device. This can lead to full system compromise, unauthorized control, and potential disruption of network services.
Mitigation Recommendations
A fix for this vulnerability is available and was introduced in commit e4ff45e. Users should update luci-proto-openvpn to a version that includes this fix (versions later than 0.11.1). Until updated, restrict access to authenticated users with OpenVPN protocol configuration privileges to trusted personnel only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-26T17:58:05.796Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a42c23927e9c79719595c0e
Added to database: 06/29/2026, 19:06:33 UTC
Last enriched: 07/15/2026, 10:20:56 UTC
Last updated: 08/13/2026, 01:38:13 UTC
Views: 100
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.