CVE-2026-62947

OpenWrt is the operating system many routers and small-network devices run to manage internet and internal traffic. This bug affects a built-in “download” web feature (cgi-io) that is supposed to only let you read specific files—an attacker can trick it into reading sensitive files that require root access, such as password hashes in /etc/shadow. Think of it like a door lock that checks for “allowed keys” before checking the exact door route, so the wrong path still leads to protected rooms.

This matters if you run OpenWrt on a router or embedded device and you’re using a version earlier than 25.12.5. It targets the cgi-io cgi-download functionality, which is exposed through the device’s web/HTTP interface.

Because the issue involves bypassing access controls via a CGI handler, treat it as a risk when the relevant web interface is reachable from the network (especially the internet) and can be reached by an attacker without additional authorization.

This is RED because the issue has been linked to Lazarus-related activity in press reporting, and there is a concrete upstream fix available. Even though public exploit code is not on record, the vulnerability’s impact (reading root-only files like /etc/shadow) makes it a high-value target for attackers.

Patch immediately to OpenWrt 25.12.5 or apply strict access restrictions to prevent untrusted access to the affected CGI download feature.

1. Confirm exposure (quick checks)

   • Log into your OpenWrt device and check the installed OpenWrt version.
   • Determine whether the version is earlier than 25.12.5. If it is, you are in the affected window per the upstream fix notes.

2. Apply the fix

   • Upgrade the device firmware to OpenWrt 25.12.5.
   • The upstream remediation indicates the fix is contained in the cgi-io changes leading to “fixed in 25.12.5”.

3. Post-upgrade validation

   • Re-check that the running version is exactly 25.12.5.
   • If you have a way to confirm component versions, ensure the cgi-io package is updated as part of the firmware upgrade.

4. If you cannot patch right away (temporary containment)

   • Limit who can reach the device’s HTTP/CGI endpoints: only allow access from trusted internal networks/VPNs.
   • Block inbound access from the internet to the router’s web/CGI services.
   • Add monitoring/alerts for unusual requests to cgi-io cgi-download patterns and any suspicious URL parameters or repeated download attempts.

5. What to monitor after patching

   • Device logs/web logs for continued attempts targeting cgi-download endpoints.
   • Any authentication failures or unexpected access patterns around the web interface.

CISA KEV timing

• This specific CVE is not listed in the CISA KEV feed (per findings), so rely on the upstream fix and your exposure assessment rather than KEV status alone.

CVE-2026-62947 affects OpenWrt’s cgi-io cgi-download handler and related rpcd session handling. The core weakness is an ACL bypass caused by authorizing the requested path before canonicalization, combined with rpcd session.c using fnmatch() in a way that permits traversal through allowed wildcard patterns (e.g., an allowed prefix followed by ../). The end result is an arbitrary root file read, including files readable only by root such as /etc/shadow.

Status and exploitation signals

• KEV: not listed in CISA KEV.
• Public exploit code: none on record.
• Press attention: rising, with reporting attributing activity to Lazarus.
• Patch: fixed in OpenWrt 25.12.5 (upstream commit and advisory provided in the findings).

Meaning of KEV here

• KEV status is not present for this CVE, so confirmed widespread exploitation is not established via KEV; however, the impact and threat reporting still justify immediate remediation as directed by the RED verdict.