A vulnerability classified as critical has been found in OpenWrt (the affected version unknown). This affects an unknown code block of the file /etc/config/rpcd of the component Access Control. The manipulation with an unknown input leads to a privilege escalation vulnerability. CWE is classifying the issue as CWE-284. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

OpenWrt mishandles access control in /etc/config/rpcd and the /usr/share/rpcd/acl.d files, which allows remote authenticated users to call arbitrary methods (i.e., achieve ubus access over HTTP) that were only supposed to be accessible to a specific user, as demonstrated by the file, log, and service namespaces, potentially leading to remote Information Disclosure or Code Execution.

The bug was discovered 05/16/2018. The weakness was released 06/19/2018 (Website). It is possible to read the advisory at blog.hac425.top. This vulnerability is uniquely identified as CVE-2018-11116 since 05/15/2018. It is possible to initiate the attack remotely. The requirement for exploitation is a authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 34 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfoedit

Name

• OpenWrt

CPE 2.3infoedit

• 🔍

CPE 2.2infoedit

• 🔍

CVSSv3infoedit

CVSSv2infoedit

Exploitinginfoedit

Threat Intelligenceinfoedit

Countermeasuresinfoedit

Timelineinfoedit

Sourcesinfoedit

Entryinfoedit

Comments