CVE-2026-55159

Executive Summary

CVE-2026-55159 is a command-injection vulnerability in the OpenWrt LuCI package luci-app-adblock-fast, a web UI for a lightweight DNS-based ad-blocker. The luci.adblock-fast.setCronEntry RPC method fails to sanitize carriage-return (CR) and line-feed (LF) characters in the entry argument before serializing it into /etc/crontabs/root, allowing an authenticated user holding the component write ACL to inject an additional physical root cron entry and achieve persistent command execution as UID 0. With a CVSS base score of 8.8 (High), the impact is full compromise of confidentiality, integrity, and availability on affected router and embedded-device deployments, though exploitation requires authenticated access and the delegated write ACL — it is not demonstrated for unauthenticated callers.

Technical Analysis

The vulnerability resides in the LuCI RPC backend for the ad-blocker application, located at applications/luci-app-adblock-fast/root/usr/share/rpcd/ucode/luci.adblock-fast. This backend exposes an RPC method named luci.adblock-fast.setCronEntry. The method accepts a caller-supplied entry argument that is intended to represent a single cron schedule line. Before writing, the method serializes this value into the system root crontab file at /etc/crontabs/root.

The core defect is improper neutralization of CR/LF sequences (CWE-93: Improper Neutralization of CRLF Sequences, often referred to as CRLF Injection). Because entry is not stripped of \r or \n characters, a value containing an embedded newline is written to the crontab as though it were one logical line from the application's perspective, but cron interprets each physical line as an independent job definition. An attacker who controls the entry value can therefore append a second, attacker-chosen physical line to the crontab.

The result is a second cron schedule that cron daemon executes under UID 0, since /etc/crontabs/root is the root user's crontab. This is a classic injection-into-a-configuration-file pattern where an application-level value crosses a trust boundary into a line-oriented configuration format without newline escaping. The write ACL for luci-app-adblock-fast is the sole gating control: any principal granted that ACL can reach the vulnerable method through the LuCI/rpcd interface. The NVD record explicitly notes the issue is "not demonstrated for unauthenticated callers or users without the component write ACL," confirming that authentication plus the delegated write privilege is a precondition. Note that in OpenWrt deployments, delegated LuCI users are frequently granted per-application write access, so the population at risk is not limited to full administrators. No patch evidence was available from any tracked source at the time of writing (patch confidence 0/4), although the NVD description states the issue is fixed in version 1.2.4-2.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE, and it has not been added to CISA KEV. The EPSS score has not yet been assigned by FIRST.org. All exploitation details in the following section are inferred strictly from the documented vulnerability class (CRLF injection into a root crontab) and the NVD description; no fabricated code, endpoints, or parameter names are asserted beyond those quoted in the source data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the documented vulnerability class and the verbatim details in the NVD description.

1. Reconnaissance / target identification. An attacker identifies an OpenWrt device exposing the LuCI web interface (typically over HTTPS on port 443 or HTTP on port 80) with the luci-app-adblock-fast package installed. Because the vulnerable component is reachable via the LuCI/rpcd RPC surface, the attacker must first hold valid credentials for a LuCI user that has been granted the luci-app-adblock-fast write ACL. Reconnaissance focuses on identifying deployments running versions prior to 1.2.4-2 and enumerating delegated user accounts with component-level write privileges.

2. Triggering the flaw. Using an authenticated session carrying the write ACL, the attacker invokes the luci.adblock-fast.setCronEntry RPC method and supplies an entry value that embeds CR or LF characters followed by a malicious second line. Because the backend does not strip these control characters, the value is written to /etc/crontabs/root with the injected physical line treated as a separate cron job.

3. Execution method. The surviving injected cron job runs under UID 0 when the cron daemon processes /etc/crontabs/root. At the vulnerability-class level, this yields arbitrary command execution as root; the attacker controls the schedule and the command via the injected line. No specific command strings or code patterns are documented in the source data, so they are not asserted here.

4. Post-exploitation impact. The injected cron entry is persistent across reboots, giving the attacker durable root-level foothold on the device. From root on an OpenWrt router, an adversary can pivot into the local network, tamper with DNS resolution (the ad-blocker itself mediates DNS), disable logging or security controls, stage further implants, or use the device as a network position for lateral movement. The high confidentiality/integrity/availability subscores reflect this full-device compromise.

Impact Assessment

CVE-2026-55159 carries a CVSS v3.1 base score of 8.8 (High), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The subscores indicate a remotely reachable (AV:N) vulnerability with low attack complexity (AC:L) that requires low privileges (PR:L) — concretely, an authenticated LuCI user with the luci-app-adblock-fast write ACL — and no user interaction (UI:N). The scope is unchanged (S:U), but confidentiality, integrity, and availability impacts are all High because the injected cron job executes as UID 0 on /etc/crontabs/root, granting complete control of the device.

Business impact centers on network-edge and embedded infrastructure: OpenWrt-based routers, gateways, and consumer/SOHO edge devices that expose the LuCI management plane to untrusted or semi-trusted users. Blast radius includes the compromised device itself and any downstream network it serves, since a root-level foothold on an edge router is a high-value pivot point. The requirement for valid credentials and the component write ACL limits mass opportunistic exploitation, but it raises risk in multi-user or managed deployments where per-application write privileges are delegated broadly. The lack of a CISA KEV listing and absence of a public PoC or EPSS score indicate the current real-world exploitation likelihood is unquantified; organizations should treat the flaw as serious due to the persistent root-level outcome despite the privilege precondition. Note that the source data does not specify an affected version range beyond "prior to 1.2.4-2," and no affected-version list was supplied.

Detection Guidance

Sigma Rule

title: LuCI adblock-fast setCronEntry CRLF Injection to Root Crontab
id: 4a7c1e9b-2b6d-4f3a-9c1e-7d5b8a2f6c10
status: experimental
description: Detects modification of the root crontab following a LuCI adblock-fast setCronEntry RPC call, which may indicate CRLF injection (CVE-2026-55159).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55159
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_cronfile:
    type: 'PATH'
    name: '/etc/crontabs/root'
    nametype: 'CREATE|OPEN|WRITE'
  condition: selection_cronfile
falsepositives:
  - Legitimate administrative edits to the root crontab via the LuCI ad-blocker UI
level: high
tags:
  - attack.t1053.003
  - cve.2026.55159

YARA Rule

rule CVE_2026_55159_adblock_fast_cron_injection
{
    meta:
        author = "valtersit.com"
        description = "Detects root crontab entries containing embedded CRLF sequences indicative of setCronEntry injection (CVE-2026-55159)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55159"
        date = "2026-01-01"
    strings:
        $crontab_path = "/etc/crontabs/root" ascii
        $rpc_method = "luci.adblock-fast.setCronEntry" ascii
        $crlf = /\r\n/
    condition:
        $crontab_path or $rpc_method or (2 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55159 LuCI adblock-fast setCronEntry CRLF Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi-bin/luci"; http.request_body; content:"setCronEntry"; nocase; http.request_body; pcre:"/(%0D%0A|%0d%0a|\\r\\n)/Ri"; reference:cve,2026-55159; classtype:attempted-admin; sid:202655159; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=1m
  [network where event.category == "network" and http.request.method == "POST" and
     http.request.body contains "setCronEntry"]
  [file where event.category == "file" and file.path == "/etc/crontabs/root" and
     event.action in ("write", "modification", "change")]

Splunk SPL Query

index=linux OR index=openwrt sourcetype=auditd OR sourcetype=syslog
| search ("/etc/crontabs/root" OR "luci.adblock-fast.setCronEntry" OR "setCronEntry")
| where match(_raw, "(?i)(%0d%0a|%0d|%0a|\\r\\n)")
| stats count min(_time) as first_seen max(_time) as last_seen values(user) as users by host, process
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="openwrt,cve-2026-55159,">
  <rule id="100559" level="12">
    <decoded_as>json</decoded_as>
    <field name="syscall">open|write</field>
    <field name="file">/etc/crontabs/root</field>
    <description>CVE-2026-55159: Root crontab modified - possible adblock-fast setCronEntry CRLF injection</description>
    <mitre>
      <id>T1053.003</id>
    </mitre>
    <group>cron_persistence,</group>
  </rule>
  <rule id="100560" level="10">
    <match>setCronEntry</match>
    <description>CVE-2026-55159: adblock-fast setCronEntry RPC invocation observed</description>
    <group>cron_persistence,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the vulnerability is fixed in version 1.2.4-2, but no vendor advisory or patch reference was available from tracked sources at time of writing; treat the version string as the stated fix target and verify against the upstream luci-app-adblock-fast repository before relying on it.

1. Immediate mitigations:

• Restrict the luci-app-adblock-fast write ACL to the smallest possible set of trusted administrators; audit and revoke delegated write access from non-essential LuCI users.
• Disable or remove the luci-app-adblock-fast package on devices where DNS-based ad-blocking via LuCI is not required.
• Restrict network access to the LuCI management interface (do not expose it to untrusted networks; bind it to a management VLAN or local-only interface).
• Monitor /etc/crontabs/root for unexpected modifications and alert on any cron entries that do not correspond to known-good configuration.

2. Patch/upgrade steps:

• Upgrade luci-app-adblock-fast to 1.2.4-2 or later once the fix is available via the OpenWrt package feeds.
• After upgrading, re-review /etc/crontabs/root and remove any injected or unrecognized entries, then restart the cron service.
• Validate the applied package version against the upstream release artifacts to confirm the CR/LF sanitization fix is present.

3. Long-term hardening:

• Apply least-privilege principles to LuCI per-application ACLs; avoid granting write ACLs to shared or service accounts.
• Adopt input-validation requirements for any application that serializes caller-supplied data into line-oriented configuration files (crontab, conffiles), enforcing CR/LF stripping at the boundary.
• Maintain firmware/package patch hygiene on OpenWrt edge devices and monitor upstream package changelogs for security fixes, since these devices are frequently internet-exposed and rarely centrally managed.

References

• NVD — CVE-2026-55159: https://nvd.nist.gov/vuln/detail/CVE-2026-55159
• CWE-93 — Improper Neutralization of CRLF Sequences: https://cwe.mitre.org/data/definitions/93.html
• MITRE ATT&CK — T1053.003 Scheduled Task/Job: Cron: https://attack.mitre.org/techniques/T1053/003/
• OpenWrt LuCI / luci-app-adblock-fast upstream project (verify 1.2.4-2 fix): https://github.com/openwrt/luci
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-55159 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog No known threat actor campaigns or exploit-in-the-wild evidence were identified in the source data; EPSS has not yet been scored and no public PoC, Nuclei template, or exploit code is available.