CVE-2026-30874

CVE-2026-30874 impacts OpenWrt Project versions prior to 24.10.6, where a flaw in the hotplug_call function's environment variable filtering allows an attacker to bypass PATH variable restrictions. This vulnerability enables a local attacker with low privileges to inject an arbitrary PATH, potentially leading to privilege escalation by controlling binaries executed by elevated scripts. Rated 7.8 HIGH on the CVSS scale, it presents a significant risk to confidentiality, integrity, and availability due to its low attack complexity once local access is obtained. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion regarding this vulnerability.