Read the docs
TI-2026-23703 Aliases CVE-2026-30874

OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation

Priority LOW 10CWE-187Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Privilege escalation
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scripts in /etc/hotplug.d, but a bug using strcmp instead of strncmp causes the filter to compare the full environment string (e.g., PATH=/some/value) against the literal "PATH", so the match always fails. As a result, the PATH variable is never excluded, enabling an attacker to control which binaries are executed by procd-invoked scripts running with elevated privileges. This issue has been fixed in version 24.10.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed openwrt (openwrt): 24.10.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwrtopenwrtbefore 24.10.624.10.6Patch availableCNA
  • openwrt Vendoropenwrt Affected before 24.10.6 Fixed in 24.10.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*before 24.10.6Vulnerableopenwrt
  • cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:* Versions before 24.10.6 Vulnerable ·openwrt

Remediation

  • Fix · CNA openwrt (openwrt) Fixed in 24.10.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-30874

References

Patch 2

  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2026-44983 Cross-site scripting in openwrt CVSS 3.1CRITICAL 9.6
  • TI-2026-40045 OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service CVSS 3.1MEDIUM 6.5
  • TI-2023-09914 LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored… CVSS 3.1MEDIUM 5.4
  • TI-2026-44982 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download CVSS 3.1MEDIUM 4.9
  • TI-2026-23701 OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup CVSS 4.0CRITICAL 9.5
See all 136 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences