Executive brief
LuCI, the web interface for OpenWrt routers, contains a security flaw in how it displays network device names. An attacker on the local network can send a specially crafted device name that, when viewed by a router administrator, executes malicious code in the admin's browser. This could allow the attacker to change router settings, steal session information, or gain unauthorized access to the management interface.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in LuCI due to improper neutralization of DHCPv6 Client FQDN (hostname) data. An unauthenticated adjacent-network attacker can send a DHCPv6 Solicit/Request containing HTML markup in the FQDN option. The odhcpd daemon stores this value, which is subsequently retrieved by luci-rpc.getDHCPLeases and rendered via innerHTML in the LuCI status and DHCP configuration tables (specifically in luci-mod-status and luci-mod-network). When an authenticated administrator views the 'Status > Overview' or 'Network > DHCP and DNS' pages, the injected script executes in the context of their session. The vulnerability is rooted in the use of L.dom.append() with raw strings in cbi.js and ui.js.
Affected products
- OpenWrt LuCI master
Timeline
- 2026-06-27: advisory: GitHub Security Advisory published by OpenWrt developers
- 2026-07-12: disclosed: CVE published to NVD dataset