# CVE-2026-62948: OpenWrt odhcpd and LuCI stored XSS via DHCPv6 hostname injection

Source: https://junglewise.ai/threats/cve-2026-62948-openwrt-odhcpd-and-luci-stored-xss-via-dhcpv6-hostname-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-62948 · Severity: critical · CVSS 9.6 · Published 2026-07-15

OpenWrt is an open-source operating system used for routers and embedded devices. A vulnerability in its DHCP server and web interface allows an unauthenticated person on the local network to inject malicious code into the device's administration panel. If an administrator views the DHCP status page, this code could allow the attacker to take full control of the router, steal credentials, or modify network settings.

Technologies: [OpenWrt](https://junglewise.ai/threats/technologies/openwrt). Vendors: [OpenWrt](https://junglewise.ai/threats/vendors/openwrt).

## Quick answers

**Is CVE-2026-62948 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62948 being exploited in the wild.

**How severe is CVE-2026-62948?** Critical severity, with a CVSS score of 9.6, published 15 July 2026.

**Which products and versions are affected?** OpenWrt < 25.12.5.

**Is there a fix for CVE-2026-62948?** A patch was published on 2026-06-27: Fixes merged into odhcpd and LuCI repositories Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62948 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-62948?** Check whether you run OpenWrt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in OpenWrt's odhcpd (DHCP server) and LuCI (web interface) due to improper neutralization of input in DHCPv6 client FQDN options. The odhcpd daemon writes client-provided hostnames (Option 39) into /tmp/odhcpd.leases without escaping newlines or spaces, allowing an unauthenticated adjacent attacker to inject forged lease records. When an administrator views the 'Active DHCPv6 Leases' page in LuCI, the web interface fails to escape this data, leading to stored Cross-Site Scripting (XSS). An attacker can leverage this to execute arbitrary JavaScript in the context of the admin's session, potentially leading to full device compromise. The issue is fixed in OpenWrt version 25.12.5 by implementing LDH (Letters, Digits, Hyphens) character escaping in odhcpd and HTML escaping in LuCI.

## Affected products

- OpenWrt OpenWrt < 25.12.5

## Timeline

- 2026-06-27: patched: Fixes merged into odhcpd and LuCI repositories
- 2026-07-01: advisory: OpenWrt 25.12.5 released with security fixes
- 2026-07-15: disclosed: CVE-2026-62948 published

## References

- [https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048a](https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048a)
- [https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3a](https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3a)
- [https://github.com/openwrt/odhcpd/pull/404](https://github.com/openwrt/odhcpd/pull/404)
- [https://github.com/openwrt/openwrt/releases/tag/v25.12.5](https://github.com/openwrt/openwrt/releases/tag/v25.12.5)
- [https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f](https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f)

## Related threats

- [OpenWrt cgi-io path traversal in cgi-download and cgi-exec](https://junglewise.ai/threats/cve-2026-62947-openwrt-cgi-io-path-traversal-in-cgi-download-and-cgi-exec)
- [OpenWrt Emergency Access Daemon integer underflow in handle_send_a](https://junglewise.ai/threats/cve-2026-55490-openwrt-emergency-access-daemon-integer-underflow-in-handle-send)
- [OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30872-openwrt-project-is-a-linux-operating-system-targeting-embedded)
- [OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the…](https://junglewise.ai/threats/cve-2026-30871-openwrt-project-is-a-linux-operating-system-targeting-embedded)
- [In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…](https://junglewise.ai/threats/cve-2025-20748-in-wlan-ap-driver-there-is-a-possible-out-of-bounds-write-due-to)