Vulnerability Description
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/openwrt/luci/commit/d9bbc372e29618a8807b693a1ccf6d0e42cd196c
- https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m
- https://www.vulncheck.com/advisories/luci-app-banip-log-monitor-ip-extraction-by
- https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m
FAQ
What is CVE-2026-62184?
CVE-2026-62184 is a vulnerability with a CVSS score of 7.5 (HIGH). luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs v...
How severe is CVE-2026-62184?
CVE-2026-62184 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-62184?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.