CyberRota Analysis
AI-GeneratedThe cgi-download handler in OpenWrt prior to version 25.12.5 is vulnerable to directory traversal attacks due to improper authorization checks and the use of fnmatch() without FNM_PATHNAME, potentially allowing unauthorized access to sensitive files like /etc/shadow. This vulnerability poses a risk to embedded devices running OpenWrt, making it crucial for users and administrators of affected systems to prioritize upgrading to the patched version to mitigate potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)