Executive Summary
In July 2026, Hacker House disclosed several high-impact vulnerabilities identified through a novel 'inference fuzzing' methodology. The most critical finding is an unauthenticated directory traversal vulnerability in the OpenWRT `luci-app-bmx7` package, which allows remote attackers to read sensitive files such as `/etc/shadow` and obtain root credentials. Despite notification on July 8, the OpenWRT project has reportedly not responded, leading to full disclosure.
Technical analysis also confirmed a command injection vulnerability in the Horde Virtual File System (CVE-2026-60102) due to improper shell-escaping in the SMB driver. Other findings include pre-authentication stored XSS in the OpenWRT OLSR mesh interface and various accepted-risk behaviors in WordPress involving XML-RPC amplification and SSRF. These vulnerabilities highlight significant risks to community mesh networks and enterprise web applications.
The business impact for OpenWRT users, particularly in community or mesh environments, is severe as the exploit requires no credentials and leads to full device takeover. Organizations using Horde VFS should update to version 3.0.1 immediately to mitigate remote code execution risks.