CVE-2026-30874
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scripts in /etc/hotplug.d, but a bug using strcmp instead of strncmp causes the filter to compare the full environment string (e.g., PATH=/some/value) against the literal "PATH", so the match always fails. As a result, the PATH variable is never excluded, enabling an attacker to control which binaries are executed by procd-invoked scripts running with elevated privileges. This issue has been fixed in version 24.10.6.
Scoring
- Severity
- LOW
- CVSS base score
- 1.8
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.30%
- CWE
- CWE-187, CWE-74, CWE-269
- Published
- 2026-03-19
- Last modified
- 2026-03-20
Affected products
- openwrt openwrt
Weakness type
Related vulnerabilities
- CVE-2026-87853 — Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation
- CVE-2026-84376 — Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base
- CVE-2026-62750 — Windows HTTP Protocol Stack Tampering Vulnerability
- CVE-2026-14687 — 666ghj BettaFish InsightEngine search-result Deduplication agent.py _deduplicate_results partial string comparison
- CVE-2026-45692 — Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- CVE-2026-55602 — http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass
- CVE-2026-44837 — view_component: System Test Entry Point Path Check Allows Sibling Directory Escape
- CVE-2026-35031 — Jellyfin: Potential RCE via subtitle upload path traversal + .strm chain