CVE-2026-62184

Name of the Vulnerable Software and Affected Versions luci-app-banip versions 0 through 0.11.1

Description A log parsing flaw exists where the awk-based parser extracts the first IPv4 address from log lines regardless of its field position. This allows an unauthenticated remote attacker to inject an arbitrary IP address through attacker-controlled fields, such as the login username field. Consequently, the system may block an incorrect target while the actual attacker remains unblocked.

Recommendations Update luci-app-banip to a version later than 0.11.1.