CVE-2026-72840 in OpenWrt
Summary
by MITRE • 08/14/2026
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
This vulnerability exists within the OpenWrt LuCI web interface where the luci-mod-system-mounts module implements an overly permissive access control list that incorrectly grants write privileges to the critical system file /etc/crontabs/root. The flaw stems from improper privilege separation where users assigned exclusively to mount configuration tasks receive unnecessary write permissions that extend beyond their intended scope. This misconfiguration creates a path for privilege escalation through the ubus interface, allowing authenticated users with mount-configuration privileges to append arbitrary cron entries using the file.write method. The vulnerability manifests when an attacker leverages their limited access rights to inject malicious cron jobs into the root user's crontab file.
The technical implementation of this flaw involves the ubus RPC mechanism which provides a bridge between the web interface and underlying system functions. When users with mount-configuration permissions execute file.write operations through ubus, they can directly modify the /etc/crontabs/root file without proper authorization checks. The busybox crond daemon running with root privileges processes these cron entries automatically within approximately one minute of creation, creating an immediate execution window for malicious payloads. This timing aspect makes the vulnerability particularly dangerous as it allows for rapid exploitation and command execution with elevated privileges.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass full system compromise capabilities. An attacker can establish persistent backdoors, execute arbitrary code, modify system configurations, or even deploy malware through the injected cron jobs. The default nature of the busybox crond daemon means that most OpenWrt installations are vulnerable without requiring additional attack vectors. This vulnerability specifically aligns with CWE-284 (Improper Access Control) and represents a classic case of privilege creep where users receive more permissions than necessary for their designated tasks. The flaw demonstrates poor adherence to the principle of least privilege, which is fundamental to secure system design.
Security mitigations should focus on implementing proper access control enforcement within the LuCI modules, specifically ensuring that mount configuration users cannot write to critical system files like /etc/crontabs/root. The recommended approach involves modifying the ACL definitions in luci-mod-system-mounts to remove write permissions for sensitive system files while maintaining necessary functionality for legitimate mount operations. Additionally, implementing ubus method access controls and adding proper input validation for file.write operations would prevent unauthorized modifications. Organizations should also consider implementing regular security audits of access control lists and privilege assignments, utilizing ATT&CK framework techniques for detecting unauthorized privilege escalation attempts. System administrators should monitor cron job creation activities as an indicator of potential exploitation attempts and ensure that all OpenWrt systems are updated to versions with corrected ACL implementations. The vulnerability highlights the importance of maintaining strict separation between different functional modules within web interfaces and implementing defense-in-depth strategies to prevent lateral movement through compromised accounts.