OpenWRT Luci CGI Command Injection (CVE-2023-1389) for 2026-10-19

Oct 19, 2026 Exploitation

Last Updated: 00:00 UTC

Unauthenticated OS command injection via the country parameter of /cgi-bin/luci/;stok=/locale. The ;stok= path segment bypasses CSRF token validation, making the injection exploitable without credentials. Active exploitation payloads download and execute Mirai-family botnet implants via wget or curl from attacker-controlled infrastructure.

CVE References

CVE-2023-1389

MITRE ATT&CK

Tactic: Initial Access (TA0001)
Technique: T1190 — Exploit Public-Facing Application

Observed URIs

Attackers by Country

The Netherlands: 59South Korea: 42United States: 39Poland: 26Germany: 18Lithuania: 16Italy: 15United Kingdom: 10Brazil: 9Seychelles: 9Bulgaria: 9France: 8Hong Kong: 6Switzerland: 6India: 5Japan: 5Russia: 4Sweden: 4China: 3Vietnam: 3Canada: 3Iran: 3Indonesia: 2Australia: 2Norway: 2Spain: 2New Zealand: 2Morocco: 2United Arab Emirates: 2Nigeria: 1Taiwan: 1Malaysia: 1Panama: 1Chile: 1Mexico: 1Monaco: 1South Africa: 1Moldova: 1Latvia: 1Belize: 1Antigua and Barbuda: 1Ukraine: 1Kazakhstan: 1Romania: 1Singapore: 1Slovakia: 1Greece: 1
The Netherlands5917.7%
South Korea4212.6%
United States3911.7%
Poland267.8%
Germany185.4%
Lithuania164.8%
Italy154.5%
United Kingdom103.0%
Brazil92.7%
Seychelles92.7%
Bulgaria92.7%
France82.4%
Hong Kong61.8%
Switzerland61.8%
India51.5%
Japan51.5%
Russia41.2%
Sweden41.2%
China30.9%
Vietnam30.9%
Canada30.9%
Iran30.9%
Indonesia20.6%
Australia20.6%
Norway20.6%
Spain20.6%
New Zealand20.6%
Morocco20.6%
United Arab Emirates20.6%
Nigeria10.3%
Taiwan10.3%
Malaysia10.3%
Panama10.3%
Chile10.3%
Mexico10.3%
Monaco10.3%
South Africa10.3%
Moldova10.3%
Latvia10.3%
Belize10.3%
Antigua and Barbuda10.3%
Ukraine10.3%
Kazakhstan10.3%
Romania10.3%
Singapore10.3%
Slovakia10.3%
Greece10.3%

IP Address : ASN : City/Provider

Share on: