CVE-2026-72840 — OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration…
Published: 2026-08-13 · CVSS: 8.7 · CVSS 4.0
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7