Is CVE-2026-61875 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61875 being exploited in the wild.

How severe is CVE-2026-61875?

High severity, with a CVSS score of 8.8, published 12 July 2026.

Is there a fix for CVE-2026-61875?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-61875 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-61875?

Check whether you run OpenWrt Luci-App-Upnp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61875: OpenWrt luci-app-upnp stored XSS via UPnP port mapping description

CVE-2026-61875 · Severity: high · CVSS 8.8 · Published 2026-07-12

A security vulnerability exists in the UPnP management interface for OpenWrt routers. An unauthenticated device on the local network can send a specially crafted request that hides malicious code within a port-mapping description. When a router administrator later views the UPnP status or settings pages, this code executes in their browser, potentially allowing the attacker to take control of the router or steal administrative session data.

Vendors: OpenWrt.

Quick answers

Is CVE-2026-61875 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61875 being exploited in the wild.
How severe is CVE-2026-61875?: High severity, with a CVSS score of 8.8, published 12 July 2026.
Which products and versions are affected?: OpenWrt Luci-App-Upnp master.
Is there a fix for CVE-2026-61875?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-61875 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-61875?: Check whether you run OpenWrt Luci-App-Upnp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in luci-app-upnp due to improper output encoding of UPnP port mapping descriptions. An unauthenticated attacker on the local network can issue a 'AddPortMapping' SOAP request to the miniupnpd service containing a malicious JavaScript payload in the 'NewPortMappingDescription' field. The miniupnpd daemon stores this description in its lease file. When an administrator accesses the LuCI web interface (specifically the UPnP or Status Overview pages), the RPC backend retrieves this data and the frontend renders it using cbi_update_table() without proper sanitization, leading to execution in the administrator's browser context. The vulnerability is rooted in the use of innerHTML via dom.append() for plain string cell values.

Affected products

OpenWrt luci-app-upnp master

Timeline

2026-06-27: advisory: Initial GitHub Security Advisory published by OpenWrt project
2026-07-12: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.