CVE-2026-62948
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability in OpenWrt prior to 25.12.5 allows newline injection into /tmp/odhcpd.leases via the DHCPv6 FQDN option 39 hostname. Lack of escaping enables forged lease lines that are rendered as live HTML on the Active DHCPv6 Leases admin page in LuCI.
Risk Assessment
An attacker can inject malicious HTML/JavaScript, leading to XSS attacks on the admin interface. This could result in session theft, account takeover, or further compromise of the device.
Recommendation
Immediately update OpenWrt to version 25.12.5 or later, which includes a fix preventing newline injection in lease files.
Original NVD description (English source)
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.