CVE-2026-55897: luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot read ACL in applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json grants rpcd file.exec permission for the general shell interpreter /bin/sh. An authenticated delegated session with that read ACL can supply caller-controlled params; rpcd authorizes the executable path and passes those arguments to the shell, allowing arbitrary commands to execute as root. Builds without the /bin/sh exec grant, including the checked openwrt-24.10 and openwrt-23.05 branches, are not affected by this specific chain. This vulnerability is fixed in 1.1.2-6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openwrt/luci-app-advanced-rebootto a version that resolves this vulnerability.Fixed in 1.1.2-6 - Configuration
In applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json, ensure the luci-app-advanced-reboot read ACL does not grant rpcd file.exec permission for the general shell interpreter /bin/sh (prior to 1.1.2-6, it does).
OpenWrt luci-app-advanced-reboot rpcd ACL (applications/luci-app-advanced-reboot/root/usr/share/rpcd/acl.d/luci-app-advanced-reboot.json) file.exec permission for /bin/sh = Remove/stop granting rpcd file.exec for /bin/sh (only before 1.1.2-6)
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated delegated LuCI session that has the luci-app-advanced-reboot read ACL. No user interaction is required after authentication.
Are standard OpenWrt 24.10 or 23.05 builds affected?
The checked openwrt-24.10 and openwrt-23.05 branches do not include the /bin/sh file.exec grant and are not affected by this specific exploitation chain.
What access does successful exploitation provide?
The attacker can pass controlled arguments to /bin/sh through rpcd file.exec, resulting in arbitrary command execution as root on the router.
What version fixes the issue?
The issue is fixed in luci-app-advanced-reboot version 1.1.2-6. If updating is not immediately possible, remove or avoid granting delegated sessions the affected application's read ACL.