luci-app-upnp CVE-2026-61875

Requires that the UPnP IGD service (miniupnpd) is enabled and accepting AddPortMapping requests - the default when luci-app-upnp/miniupnpd are installed and turned on - and that the attacker can reach the UPnP control endpoint, which is normally exposed to LAN clients only (no authentication needed, consistent with PR:N). Exploitation is limited by the need for administrator user interaction (UI:P): the injected payload only executes when an admin actually views the UPnP or Status page in LuCI. It is further limited to environments where UPnP is deployed and enabled; routers with UPnP disabled or the package not installed are not exploitable, and the attacker must already have LAN adjacency rather than pure internet access.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) describes an unauthenticated, low-complexity attack whose only gating factor is passive user interaction - the admin merely viewing the UPnP or Status page - yielding high confidentiality and integrity impact to the vulnerable system (VC:H/VI:H) and a score of 8.7. That said, 'AV:N' overstates reach in practice: UPnP IGD control is normally exposed only to the LAN, so the realistic attacker is a host already on the local network (malware, a rogue guest device, or a compromised IoT node), not the open internet. There is no EPSS score, no KEV listing, and no published POC in the provided data, so exploitation is plausible and low-effort but not currently observed in the wild. Net priority: a genuine and easily-weaponized stored-XSS against the router management plane, but bounded by LAN adjacency and the need for an admin to open the affected page.

A malware-infected laptop or IoT device on the LAN sends a crafted UPnP AddPortMapping SOAP request to miniupnpd with a NewPortMappingDescription such as '<img src=x onerror=fetch("/cgi-bin/luci/...")>'. miniupnpd stores the mapping, and the next time the router administrator opens the LuCI UPnP or Status page, the script runs in the admin's authenticated session and can change router configuration or exfiltrate session data. No published POC is available, but the attack is low-complexity given standard UPnP tooling.