Description (CNA)
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| openwrt / luci | affected 0 before 24.10.8; affected 25.12.0 before 25.12.5 |
CWE
CWE-269
References
- https://github.com/openwrt/luci/security/advisories/GHSA-vx64-mmp7-h36c
- https://www.vulncheck.com/advisories/openwrt-luci-app-samba4-read-acl-remote-code-execution-via-smbd
ADP enrichment
No English description supplied.