The vulnerability in luci-app-lxc arises from improper access control allowing authenticated users with low privileges to access sensitive backend container management routes without proper authorization. Attackers exploit a path traversal vector using `/.%2E` in the `lxc_name` parameter to escape container directory restrictions. This enables control over host-side scripts executed through the `lxc.hook.start-host` mechanism, resulting in root-level code execution on the OpenWrt host system. The CVSS 4.0 score is 9.4, reflecting critical severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, availability, and security requirements.

Successful exploitation grants an attacker root code execution on the OpenWrt host, compromising the entire device. This can lead to full system takeover, unauthorized access to sensitive data, disruption of services, and potential pivoting to other network resources.

Patch status is not yet confirmed — check the OpenWrt vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the luci-app-lxc interface to trusted users only and monitor for suspicious activity related to container management routes. Avoid exposing the management interface to untrusted networks.