CVE-2026-62184

Katalog CVE

CVSS 7.5 · High EPSS 0,78%

Kerentanan Improper Encoding or Escaping of Output. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.

Rincian

Terbit di NVD

13 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/openwrt/luci/commit/d9bbc372e29618a8807b693a1ccf6d0e42cd196c
• https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m
• https://www.vulncheck.com/advisories/luci-app-banip-log-monitor-ip-extraction-bypass