Which versions of luci-app-upnp are affected by CVE-2026-61875?

OpenWrt's luci-app-upnp contains a stored cross-site scripting vulnerability (CVE-2026-61875, CVSS 8.7) that enables unauthenticated LAN clients to inject malicious JavaScript into the router's…

How to fix or mitigate CVE-2026-61875?

Within 24 hours: Audit all OpenWrt instances for luci-app-upnp module presence; restrict web interface access to designated trusted networks via firewall rules. Within 7 days: Disable UPnP IGD functionality if operationally feasible; implement network segmentation to isolate untrusted LAN clients from UPnP service ports (1900/UDP, 5000/TCP). Within 30 days: Subscribe to OpenWrt security advisories; apply vendor patch immediately upon release; validate remediation via vulnerability scanning.

luci-app-upnp CVE-2026-61875

Q: What is the CVSS score of CVE-2026-61875?

CVE-2026-61875 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-43235 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-12 VulnCheck

GHSA-xwgp-pprm-vcx3

XSS Openwrt Luci

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Unauthenticated LAN request (PR:N, AV:N) but payload fires only when an admin views the page (UI:R); stored XSS executes in the admin origin, changing scope (S:C) with high confidentiality/integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 12:46 vuln.today

DescriptionCVE.org

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.

AnalysisAI

Stored cross-site scripting in OpenWrt's luci-app-upnp lets an unauthenticated LAN client persist a JavaScript payload that executes in the router administrator's browser. By supplying malicious HTML in the NewPortMappingDescription field of a UPnP IGD AddPortMapping SOAP request, an attacker gets miniupnpd to store the value and luci-app-upnp to render it unencoded on the UPnP and Status pages. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 4.0 base score is 8.7 (High).

Technical ContextAI

The affected component is luci-app-upnp, the LuCI web-interface module that displays UPnP port-mapping state on OpenWrt (CPE cpe:2.3:a:openwrt:luci). It works in tandem with miniupnpd, the UPnP Internet Gateway Device daemon that accepts AddPortMapping SOAP calls from LAN hosts and records each mapping's free-text NewPortMappingDescription. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): miniupnpd persists the attacker-controlled description verbatim, and the LuCI view template emits it into the admin HTML page without output encoding, so any markup or <script>/event-handler content in the description is parsed and executed as part of the trusted admin origin.

RemediationAI

Patch available per vendor advisory: apply the fixed luci-app-upnp package published via the OpenWrt/LuCI GitHub security advisory GHSA-8v49-6387-7f89 (https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89) by running 'opkg update && opkg upgrade luci-app-upnp' (or rebuilding firmware from patched sources); an exact fixed version number is not stated in the available data and should be taken from the advisory. Where immediate patching is not possible, compensating controls include disabling the UPnP IGD service entirely (uci set upnpd.config.enabled='0' or removing miniupnpd) which stops attackers from storing descriptions but also removes automatic port-mapping for LAN clients; restricting which LAN hosts may reach the miniupnpd control endpoint via firewall rules to trusted segments only; and, as an operational precaution, avoiding the UPnP/Status LuCI pages from an authenticated admin session until patched, since rendering those pages is what triggers the stored payload.