CVE-2026-72840

This CVE exposes a privilege escalation vector in OpenWrt's LuCI web interface through the luci-mod-system-mounts module. The ACL misconfiguration grants the mounts module write access to /etc/crontabs/root via the ubus file.write interface. Because the default busybox crond executes scheduled tasks from this directory, an attacker with mount-configuration privileges can write a cron entry that executes as root within 60 seconds — direct code execution with full system compromise. The critical insight here is that this is not an isolated module flaw. The ubus ACL architecture treats 'configuration' permissions — mounts, network, wireless — as low-privilege user-facing features. But any module with file.write access to anywhere under /etc automatically gains a path to every privileged target on the system: /etc/crontabs/root, /etc/passwd, /etc/init.d/*. The privilege boundary between 'configure my storage' and 'pwn the system' collapses entirely because the filesystem layer provides no network separation between these targets. Each LuCI module with incidental /etc write access becomes a node in an exploitable graph where a single misconfiguration reaches the entire trust domain. This pattern has documented precedent — CVE-2018-17532 (OpenWrt ubus precedent) and similar vectors in pfSense (CVE-2019-12815) demonstrate that cron directories are a known pivot point that the embedded ACL design keeps missing. The genealogical record was available; it simply wasn't consulted during ubus ACL design. The remediation priority is straightforward: audit every LuCI module currently granted file.write access to any path under /etc and revoke that access unless explicitly required. However, this surgical approach leaves the underlying architectural problem intact. The ubus ACL model fundamentally lacks graph-traversal auditing — nobody is asking 'from this node, what is the transitive reach to privilege boundaries?' The design assumed isolation where none exists. Until that changes, each patched module simply redistributes the attack surface around the remaining unpatched nodes. The 60-second crond window isn't just exploitation speed — it's the gap between disclosure and patch deployment made suddenly measurable, while firmware update cycles move in months and attackers move in minutes.

Reviewed through automated stages and approved by a human before publication.