← Vulnerability feed

Vulnerability record · CVE-2019-12272 · published 23 May 2019

CVE-2019-12272: Openwrt luci os command injection vulnerability

Openwrt · Luci

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.

9.8 CVSS 3.0 Critical EPSS 7.4% · top 5.8% CWE-78 · OS command injection
9.8CVSS 3.0 base score, v2 7.5
7.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/openwrt/luci/commit/9e4b8a91384562e3baee724a52b72e30b1aa006d PatchThird Party Advisory
https://github.com/openwrt/luci/commits/master PatchThird Party Advisory
https://github.com/openwrt/luci/commit/9e4b8a91384562e3baee724a52b72e30b1aa006d PatchThird Party Advisory
https://github.com/openwrt/luci/commits/master PatchThird Party Advisory

Track CVE-2019-12272 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.1CVE-2021-27821Openwrt luci cross-site scripting vulnerabilityThe Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability.EPSS 0.59%5.4CVE-2023-24181Openwrt luci cross-site scripting vulnerabilityLuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /…EPSS 0.60%5.4CVE-2022-41435Openwrt luci cross-site scripting vulnerabilityOpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/ss…EPSS 0.51%5.3CVE-2020-10871Openwrt luci information exposure vulnerabilityIn OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the si…EPSS 1.7%4.8CVE-2026-32721Openwrt luci cross-site scripting vulnerabilityLuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan moda…EPSS 0.29%8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.65%analysed8.8CVE-2026-87491Google Chrome V8 out-of-bounds write enables sandbox code executionChrome before 153.0.8010.36 contains an out-of-bounds write in the V8 JavaScript engine. A crafted HTML page can trigger the memory corruption, and b…KEVEPSS 3.1%analysed9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed

Source: NIST National Vulnerability Database (record CVE-2019-12272), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.