CVE-2026-61876

CRITICAL9.4Cross-site scripting

Exploit

Description

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

CVSS breakdown

CVSS 4.0

Attack Vector

Adjacent

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Confidentiality (Vulnerable System)

High

Integrity (Vulnerable System)

High

Availability (Vulnerable System)

High

Confidentiality (Subsequent System)

High

Integrity (Subsequent System)

High

Availability (Subsequent System)

High

CVSS 3.1

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected products

openwrt / luci

Exploits & proofs of concept

exploit-dbLuCI DHCPv6 - Lease Hostname Stored Cross-Site Scriptingby banyamer

References

VENDOR_ADVISORYhttps://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
VENDOR_ADVISORYhttps://www.vulncheck.com/advisories/luci-dhcpv6-lease-hostname-stored-cross-site-scripting

Updated 13m ago · 8 sources