Executive brief
OpenWrt is an open-source operating system used for routers and embedded devices. A vulnerability in its DHCP server and web interface allows an unauthenticated person on the local network to inject malicious code into the device's administration panel. If an administrator views the DHCP status page, this code could allow the attacker to take full control of the router, steal credentials, or modify network settings.
Technical details
A vulnerability exists in OpenWrt's odhcpd (DHCP server) and LuCI (web interface) due to improper neutralization of input in DHCPv6 client FQDN options. The odhcpd daemon writes client-provided hostnames (Option 39) into /tmp/odhcpd.leases without escaping newlines or spaces, allowing an unauthenticated adjacent attacker to inject forged lease records. When an administrator views the 'Active DHCPv6 Leases' page in LuCI, the web interface fails to escape this data, leading to stored Cross-Site Scripting (XSS). An attacker can leverage this to execute arbitrary JavaScript in the context of the admin's session, potentially leading to full device compromise. The issue is fixed in OpenWrt version 25.12.5 by implementing LDH (Letters, Digits, Hyphens) character escaping in odhcpd and HTML escaping in LuCI.
Affected products
- OpenWrt OpenWrt < 25.12.5
Timeline
- 2026-06-27: patched: Fixes merged into odhcpd and LuCI repositories
- 2026-07-01: advisory: OpenWrt 25.12.5 released with security fixes
- 2026-07-15: disclosed: CVE-2026-62948 published
References
- https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048a
- https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3a
- https://github.com/openwrt/odhcpd/pull/404
- https://github.com/openwrt/openwrt/releases/tag/v25.12.5
- https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f