CVE-2026-61876
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The vulnerability in LuCI is due to improper encoding of DHCPv6 lease hostnames before rendering in status tables. This allows adjacent network attackers to inject HTML markup by sending a DHCPv6 Client FQDN containing script tags.
Risk Assessment
An attacker can execute malicious scripts in the administrator's browser when viewing DHCP lease pages, potentially leading to session theft, takeover of the management interface, or further privilege escalation.
Recommendation
Update LuCI immediately to a version that fixes the encoding of DHCPv6 hostnames. Until then, restrict access to the admin panel to trusted networks only.
Other vulnerabilities in LuCI
See all- CVE-2026-62381Medium
luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload written after prepending the unused-bits byte is 256 bytes, requiring one additional DER length octet. As a result the allocation is 259 bytes while the tag, length, unused-bits byte, and signature require 260 bytes, and the final memcpy writes one byte beyond the heap buffer. The overflow is reachable through the exported Lua interface via create_selfsigned(); whether it is remotely exploitable depends on the embedding application. The vulnerable code is present on the openwrt-18.06 through openwrt-25.12 release branches and is absent from master, where the luci-lib-px5g package has been removed rather than patched.
- CVE-2021-27821Medium
The LuCI web interface for OpenWRT version 19.07 and lower has been found to have a cross-site scripting (XSS) vulnerability.
Original NVD description (English source)
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.