iwallplace/cve-2026-46368-openwrt-exploitProof of Concept exploit for CVE-2026-46368 — authenticated root command injection in OpenWrt luci-app-https-dns-proxy (EDB-52521)
This repository contains the Proof of Concept (PoC) exploit for a critical OS command injection vulnerability in luci-app-https-dns-proxy that results in arbitrary command execution as root.
https-dns-proxy package, distributed through the OpenWrt community packages feed (not installed by default)2025.12.29-5setInitAction in the ubus RPC handler ()luci.https-dns-proxy/usr/libexec/rpcd/luci.https-dns-proxyluci.https-dns-proxy ACL permission can inject shell metacharacters through the name parameter of the luci.https-dns-proxy setInitAction ubus RPC call, resulting in arbitrary command execution as root on the underlying device.The setInitAction RPC method passes a user-supplied value to the system shell without proper sanitization. An authenticated LuCI user can therefore inject arbitrary shell metacharacters through the name parameter and execute commands with root privileges.
python3 exploit.py
This vulnerability and Proof-of-Concept are the original work of Ahmet Mersin, discovered and reported by the author. Please retain attribution on any reuse or republication.
Discovered and reported by @iwallplace. Users are advised to update luci-app-https-dns-proxy to a fixed release.