CVE-2026-62184 describes a log parsing vulnerability in openwrt's luci-app-banip component. The vulnerability is due to improper encoding or escaping of output, where the awk-based parser extracts the first IPv4 address from log lines regardless of its field position. An attacker can exploit this by injecting an IP address into the login username field, causing the banIP mechanism to block an incorrect IP address while the attacker remains unblocked. This can be exploited remotely without authentication. The affected versions are luci up to 0.11.1. No official patch or remediation level has been provided yet.

An unauthenticated remote attacker can manipulate the banIP blocking mechanism by injecting arbitrary IP addresses into log entries. This results in the system blocking innocent IP addresses instead of the attacker's IP, effectively bypassing the intended IP blocking protection. This can lead to denial of service for legitimate users and failure to block malicious actors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be aware of this limitation in the banIP feature and consider alternative methods to block malicious IPs. No official fix or temporary workaround has been documented at this time.