CyberRota Analysis
AI-GeneratedThe log parsing vulnerability in luci-app-banip allows unauthenticated remote attackers to inject arbitrary IP addresses through manipulated log entries, specifically by exploiting the username field. This misconfiguration can lead to incorrect blocking of legitimate users while leaving the actual attacker unblocked, potentially facilitating further attacks. Organizations using luci-app-banip should prioritize remediation to prevent unauthorized access and ensure proper IP blocking functionality.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.