CVE-2026-62184 is a vulnerability in the openwrt luci-app-banip component where the log parsing mechanism uses an awk-based parser that extracts the first IPv4 address from log entries without validating its field position. This improper encoding or escaping of output allows an unauthenticated remote attacker to inject arbitrary IP addresses via attacker-controlled fields such as the login username. Consequently, the banIP feature may block the wrong IP address, leaving the real attacker unblocked. The vulnerability affects versions up to and including 0.11.1. No official patch or remediation level has been published yet.

An unauthenticated remote attacker can exploit this vulnerability to manipulate the IP blocking mechanism of luci-app-banip, causing it to block innocent IP addresses while the attacker’s IP remains unblocked. This undermines the effectiveness of the banIP feature, potentially allowing attackers to maintain persistent unauthorized access or evade detection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should be cautious about relying solely on luci-app-banip for IP blocking and consider additional monitoring or alternative mitigation strategies.