What is the CVSS score of CVE-2026-32721?

CVE-2026-32721 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Openwrt are affected by CVE-2026-32721?

OpenWrt's LuCI web interface contains a stored cross-site scripting vulnerability that could allow attackers to execute malicious code when administrators access the wireless network scanning…

How to fix or mitigate CVE-2026-32721?

Within 24 hours: Inventory all OpenWrt deployments and identify those running affected versions (23.05-24.10.4, 23.05-25.11.x). Within 7 days: Restrict LuCI web interface access to trusted administrative networks only using firewall rules and disable remote management where possible. Within 30 days: Monitor vendor releases closely and prepare for emergency patching; consider upgrading to patched versions (24.10.6, 25.12.1, or 26.072.65753) as soon as available.

Openwrt CVE-2026-32721

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-19 GitHub_M

XSS Openwrt Luci

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 23:00 vuln.today

CVE Published

Mar 19, 2026 - 22:46 nvd

HIGH 8.6

DescriptionGitHub Advisory

LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an attacker to craft a malicious SSID containing arbitrary HTML/JavaScript. Exploitation requires the user to actively open the wireless scan modal (e.g., to connect to a Wi-Fi access point or survey nearby channels), and only affects OpenWrt versions newer than 23.05/22.03 up to the patched releases (24.10.6 and 25.12.1). The issue has been fixed in version LuCI 26.072.65753~068150b.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in the OpenWrt LuCI web interface where malicious JavaScript code embedded in Wi-Fi network names (SSIDs) can execute when users open the wireless scan modal. The vulnerability affects OpenWrt versions newer than 23.05/22.03 up to 24.10.5 and 25.12.0, allowing attackers within wireless range to compromise users who scan for available networks. No active exploitation has been reported (not in KEV), and with an EPSS score not provided, the real-world exploitation risk appears limited despite the high CVSS score of 8.6.

Technical ContextAI

The vulnerability resides in the luci-mod-network package's wireless.js file, specifically in how it handles SSID values from Wi-Fi scan results. According to the CPE data, this affects OpenWrt LuCI (cpe:2.3:a:openwrt:luci) and OpenWrt itself (cpe:2.3:a:openwrt:openwrt). The root cause is a classic stored XSS issue (CWE-79) where untrusted data from wireless access point SSIDs is passed through a template literal to dom.append(), which internally uses innerHTML without proper sanitization. This allows an attacker to craft malicious SSIDs containing HTML and JavaScript that will execute in the context of the LuCI administrative interface when rendered.

RemediationAI

Upgrade to OpenWrt LuCI version 24.10.6, 25.12.1, or later (specifically version 26.072.65753~068150b or newer) by applying the patches referenced at https://github.com/openwrt/luci/commit/068150ba5f524ef6b03817b258d31ec310053fd6 and https://github.com/openwrt/luci/commit/cdce600aaec66f762f18d608c74cbf3abcafe1c7. As a temporary mitigation, administrators should avoid using the wireless scan functionality in untrusted environments where malicious access points might be present, and consider disabling wireless scanning capabilities for non-essential administrative accounts until patching is complete.