An authenticated remote code execution vulnerability exists in OpenWrt's luci-app-https-dns-proxy component due to improper validation of user input, allowing privilege escalation via command injection. The exploit requires valid user credentials with 'https-dns-proxy' ACL permissions.
| Vendor | Product | Versions |
|---|---|---|
| openwrt | luci-app-https-dns-proxy | < 2026-01-17 |
