Executive brief
A security vulnerability exists in the UPnP management interface for OpenWrt routers. An unauthenticated device on the local network can send a specially crafted request that hides malicious code within a port-mapping description. When a router administrator later views the UPnP status or settings pages, this code executes in their browser, potentially allowing the attacker to take control of the router or steal administrative session data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in luci-app-upnp due to improper output encoding of UPnP port mapping descriptions. An unauthenticated attacker on the local network can issue a 'AddPortMapping' SOAP request to the miniupnpd service containing a malicious JavaScript payload in the 'NewPortMappingDescription' field. The miniupnpd daemon stores this description in its lease file. When an administrator accesses the LuCI web interface (specifically the UPnP or Status Overview pages), the RPC backend retrieves this data and the frontend renders it using cbi_update_table() without proper sanitization, leading to execution in the administrator's browser context. The vulnerability is rooted in the use of innerHTML via dom.append() for plain string cell values.
Affected products
- OpenWrt luci-app-upnp master
Timeline
- 2026-06-27: advisory: Initial GitHub Security Advisory published by OpenWrt project
- 2026-07-12: disclosed: CVE published to NVD dataset