Openwrt Luci Proto Openvpn vulnerabilities

1 vulnerability

Known vulnerabilities in Openwrt Luci Proto Openvpn, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2026-58000openwrtluci-proto-openvpn
EPSS score
2.71%
luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.