Luci CVE-2026-32721

Victim must be logged into OpenWrt LuCI web interface and click to open the wireless scan modal. Attacker broadcasts a malicious SSID containing arbitrary HTML/JavaScript. Affects luci-mod-network versions prior to 24.10.5 and 25.12.0.

While the CVSS 3.1 score of 8.6 appears severe, the real-world risk is more nuanced. The attack vector is Local (AV:L), requiring the attacker to be within wireless range, with Low attack complexity (AC:L) and no privileges required (PR:N). However, user interaction is required (UI:R) - the victim must actively open the wireless scan modal. The Changed scope (S:C) and High CIA impacts reflect potential administrative interface compromise. Without EPSS data or KEV listing, and no known public exploits mentioned, this appears to be a high-impact but low-likelihood vulnerability. The exploitation would require an attacker to set up a malicious access point and wait for administrators to perform wireless scans, making automated or widespread attacks impractical.

An attacker sets up a rogue Wi-Fi access point with a malicious SSID containing JavaScript payload near a target organization using vulnerable OpenWrt routers. When a network administrator opens the LuCI interface to scan for nearby wireless networks or configure Wi-Fi settings, the malicious JavaScript executes within their browser session, potentially allowing session hijacking or configuration changes. No proof-of-concept code has been publicly released, but exploitation requires only basic knowledge of XSS payloads and the ability to broadcast a crafted SSID.