OpenWRT up to 24.10.5 Environment Variable /etc/hotplug.d PATH partial string comparison

Summaryinfo

A vulnerability described as problematic has been identified in OpenWRT up to 24.10.5. Impacted is an unknown function of the file /etc/hotplug.d of the component Environment Variable Handler. Such manipulation of the argument PATH leads to partial string comparison. This vulnerability is listed as CVE-2026-30874. The attack must be carried out locally. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in OpenWRT up to 24.10.5. It has been rated as problematic. Affected by this issue is an unknown code block of the file /etc/hotplug.d of the component Environment Variable Handler. The manipulation of the argument PATH with an unknown input leads to a partial string comparison vulnerability. Using CWE to declare the problem leads to CWE-187. The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses. Impacted is confidentiality, integrity, and availability. CVE summarizes:

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scripts in /etc/hotplug.d, but a bug using strcmp instead of strncmp causes the filter to compare the full environment string (e.g., PATH=/some/value) against the literal "PATH", so the match always fails. As a result, the PATH variable is never excluded, enabling an attacker to control which binaries are executed by procd-invoked scripts running with elevated privileges. This issue has been fixed in version 24.10.6.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-30874 since 03/06/2026. The exploitation is known to be easy. Local access is required to approach this attack. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 24.10.6 eliminates this vulnerability. Applying the patch e08cdc8562f55b9ac228a21f3f7605a18c522b81 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OpenWRT

Version

• 24.10.0
• 24.10.1
• 24.10.2
• 24.10.3
• 24.10.4
• 24.10.5

License

• open-source

Website

• Product: https://github.com/openwrt/openwrt/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion