Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck

CVE-2026-62184luci-app-banip Log Monitor IP Extraction Bypass

High 7.5

In plain English

A high-severity security flaw in luci-app-banip from openwrt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 53.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.

Affected products (as reported)

Vendor	Product	Versions
openwrt	luci-app-banip	0 – through 0.11.1

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-r6hx-4f83-vp8m) vendor-advisory
Patch Commit patch
VulnCheck Advisory: luci-app-banip Log Monitor IP Extraction Bypass third-party-advisory