CyberRota Analysis
AI-GeneratedThe vulnerability in luci-app-openvpn allows authenticated users to exploit improper validation of the instance_name2 parameter during file uploads, enabling path traversal attacks. This flaw can lead to arbitrary file writes outside the intended directory, allowing attackers to upload malicious payloads that facilitate persistent root code execution by placing SSH keys in system directories. Organizations utilizing luci-app-openvpn should prioritize patching this critical vulnerability to mitigate the risk of unauthorized access and system compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot.