CVE-2019-12272

CRITICAL 9.8CVE-2019-12272 · Published 23/05/2019 · updated 17/06/2026

In short

CVE-2019-12272 is a CRITICAL (CVSS 9.8) vulnerability affecting luci (openwrt).
Chance of exploitation in the next 30 days (EPSS): 7.4%, higher than 94.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
luci openwrt	`≤ 0.10.0`	No fix yet

Description

In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.

References

openwrt/luci commit 9e4b8a9 · Patch
openwrt/luci · Patch

More vulnerabilities in luci

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

luci

openwrt

≤ 0.10.0

No fix yet

More vulnerabilities in luci

See all →