CVE-2026-62184

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/openwrt/luci/commit/d9bbc372e29618a8807b693a1ccf6d0e42cd196c
https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m
https://www.vulncheck.com/advisories/luci-app-banip-log-monitor-ip-extraction-bypass
https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m

Configurations

No configuration.

History

24 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) luci-app-banip contiene una vulnerabilidad de análisis de registros donde el analizador basado en awk extrae la primera dirección IPv4 de las líneas de registro independientemente de la posición del campo, permitiendo a los atacantes inyectar direcciones IP arbitrarias a través de campos controlados por el atacante, como los nombres de usuario. Un atacante remoto no autenticado puede inyectar una dirección IP en el campo de nombre de usuario de inicio de sesión, haciendo que banIP bloquee el objetivo incorrecto mientras el atacante real permanece sin bloquear.

Information

Published : 2026-07-13 22:16

Updated : 2026-10-24 22:10

NVD link : CVE-2026-62184

Mitre link : CVE-2026-62184

CVE.ORG link : CVE-2026-62184

JSON object : View

Products Affected

No product.

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-62184", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62184", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T18:45:43.677698Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/openwrt/luci", "vendor": "openwrt", "product": "luci-app-banip", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.11.1"}, {"status": "unaffected", "version": "d9bbc372e29618a8807b693a1ccf6d0e42cd196c", "versionType": "git"}], "packageURL": "pkg:github/openwrt/luci", "defaultStatus": "unaffected"}]}], "published": "2026-07-13T22:16:49.310", "references": [{"url": "https://github.com/openwrt/luci/commit/d9bbc372e29618a8807b693a1ccf6d0e42cd196c", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/luci-app-banip-log-monitor-ip-extraction-bypass", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked."}, {"lang": "es", "value": "luci-app-banip contiene una vulnerabilidad de an\u00e1lisis de registros donde el analizador basado en awk extrae la primera direcci\u00f3n IPv4 de las l\u00edneas de registro independientemente de la posici\u00f3n del campo, permitiendo a los atacantes inyectar direcciones IP arbitrarias a trav\u00e9s de campos controlados por el atacante, como los nombres de usuario. Un atacante remoto no autenticado puede inyectar una direcci\u00f3n IP en el campo de nombre de usuario de inicio de sesi\u00f3n, haciendo que banIP bloquee el objetivo incorrecto mientras el atacante real permanece sin bloquear."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "disclosure@vulncheck.com"}