CVE-2026-62184

HIGH 7.5

luci-app-banip Log Monitor IP Extraction Bypass

CVSS Score

7.5

EPSS Score

0.4%

EPSS Percentile

36th

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.

CWE	CWE-116
Vendor	openwrt
Product	luci-app-banip
Published	Jul 13, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for openwrt luci-app-banip

Be the first to know when new high vulnerabilities affecting openwrt luci-app-banip are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

openwrt / luci-app-banip

0 ≤ 0.11.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openwrt/luci/security/advisories/GHSA-r6hx-4f83-vp8m github.com: https://github.com/openwrt/luci/commit/d9bbc372e29618a8807b693a1ccf6d0e42cd196c vulncheck.com: https://www.vulncheck.com/advisories/luci-app-banip-log-monitor-ip-extraction-bypass

Credits

🔍 lujie (@lujiefsi)