CVE-2026-62947 openwrt CVE debrief

Who should care

Users of OpenWrt, especially those with versions prior to 25.12.5, should be aware of this vulnerability and take necessary actions to protect their systems. This includes updating to the latest version and reviewing their systems for potential exposure. System administrators and security teams responsible for OpenWrt deployments should prioritize patching and review compensating controls for exposed systems.

Technical summary

The cgi-download handler in OpenWrt's cgi-io package is vulnerable to path traversal attacks. Prior to version 25.12.5, the handler authorizes requested paths against the caller's ubus session file ACL before canonicalization. This allows an attacker to traverse the file system by using a wildcard prefix followed by ../ to access root-readable files, including /etc/shadow. The vulnerability is fixed in OpenWrt version 25.12.5. Affected users should review their systems for potential exposure and update to the latest version. The issue arises from the use of fnmatch() without FNM_PATHNAME in rpcd session.c, which enables the traversal. This vulnerability has a CVSS score of 4.9 and is considered MEDIUM severity.

Defensive priority

Medium-High

Recommended defensive actions

• Update OpenWrt to version 25.12.5 or later
• Review and restrict access to cgi-io
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is described in the NVD entry for CVE-2026-62947. The fix is available in OpenWrt version 25.12.5. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and apply patches or mitigations as needed. Additional information may be available through vendor advisories and issue tracking.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.