CVE-2021-27821

MediumCVSS 6.1

Published: 25/05/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

44th percentile - higher than 44% of all known CVEs

Summary

The LuCI web interface for OpenWRT version 19.07 and lower has been found to have a cross-site scripting (XSS) vulnerability.

Risk Assessment

An attacker can inject malicious JavaScript into the interface, potentially leading to session theft, admin account takeover, or unauthorized actions.

Recommendation

It is recommended to immediately upgrade OpenWRT to a version newer than 19.07, which includes a fix for the XSS vulnerability.

Original NVD description (English source)

The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability.