Luci App Https Dns Proxy
Approved changes feed: RSS · Atom
cpe:2.3:a:mossdef-org:luci-app-https-dns-proxy:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mossdef Org (481a1ef8-04eb-5628-8fb9-d45401073ec7) |
|---|---|
| Product | Luci App Https Dns Proxy (059afcf5-bff7-51d4-bf6d-800fe48169f7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46368 |
vulnerable | 2026-06-08 08:05:12.053441 |
luci-app-https-dns-proxy Authenticated Command Injection via setInitAction
HIGH (8.8)
luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distributed through the OpenWrt community packages feed and not installed by default — contains a command injection vulnerability in the setInitAction function. An authenticated user holding the luci.https-dns-proxy ACL permission can inject shell metacharacters through the 'name' parameter of a ubus RPC call to luci.https-dns-proxy setInitAction, resulting in arbitrary command execution as root on the underlying device. Core OpenWrt is not affected; only installations that have opted in to the luci-app-https-dns-proxy package are vulnerable.
Published: 2026-05-26T14:08:51.764Z
Updated: 2026-07-14T21:32:56.384Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.