CVE-2026-62184 luci-app-banip Log Monitor IP Extraction Bypass
Attackers can bypass IP blocking by injecting fake IPs into login fields, causing the banIP plugin to block innocent targets while the attacker remains active.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62184?
CVE-2026-62184 is a high-severity vulnerability in openwrt luci-app-banip, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.
Weakness: CWE-116
Which versions are affected by CVE-2026-62184?
How do I fix CVE-2026-62184?
No fix has been published for CVE-2026-62184 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-62184 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62184 exists.
Sources
Also known as GHSA-2532-qx65-h9m6, GHSA-r6hx-4f83-vp8m.