CVE-2026-55159: luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-feed characters and serializes it into /etc/crontabs/root as though it were one logical line. An authenticated delegated user with the luci-app-adblock-fast write ACL can therefore create an additional physical root cron entry through applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast, resulting in persistent command execution as UID 0 when cron runs. The issue is not demonstrated for unauthenticated callers or users without the component write ACL. This vulnerability is fixed in 1.2.4-2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
luci-app-adblock-fastto a version that resolves this vulnerability.Fixed in 1.2.4-2
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated delegated user who has the luci-app-adblock-fast write ACL can exploit it. It is not demonstrated for unauthenticated callers or users without that component write permission.
What access does an attacker need, and what is the impact?
The attacker needs authenticated access to the LuCI RPC method and permission to write luci-app-adblock-fast settings. By injecting carriage-return or line-feed characters into a cron entry, they can add a separate root cron job and obtain persistent command execution as UID 0 when cron runs.
How can I determine whether my installation is affected?
Installations running luci-app-adblock-fast prior to version 1.2.4-2 are affected if delegated users have the component's write ACL. Review /etc/crontabs/root for unexpected cron entries and audit delegated LuCI accounts with luci-app-adblock-fast write access.
What should be done if an immediate upgrade is not possible?
Remove luci-app-adblock-fast write ACL access from delegated users until the package can be updated. Also inspect and remove unauthorized entries in /etc/crontabs/root, since injected jobs can persist and run as root.