Which versions of OpenWrt LuCI are affected by CVE-2026-61876?

OpenWrt's LuCI administration panel contains a stored cross-site scripting vulnerability (CVSS 9.4) that enables network-adjacent attackers to gain administrative control through malicious DHCP…

Is there a public PoC exploit available for CVE-2026-61876?

Yes, a public proof-of-concept exploit is available for CVE-2026-61876. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-61876?

Within 24 hours: Audit all OpenWrt deployments in your infrastructure and disable LuCI web interface where operationally feasible. Within 7 days: Implement network-layer access controls restricting adjacent-network connectivity to vulnerable routers and disable DHCPv6 if operationally acceptable. Within 30 days: Apply vendor-released patches upon availability and conduct comprehensive security reassessment of affected deployments.

OpenWrt LuCI CVE-2026-61876

Q: What is the CVSS score of CVE-2026-61876?

CVE-2026-61876 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43236 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-12 VulnCheck

GHSA-8gvq-r3c7-vwmv

XSS Openwrt Luci

9.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Adjacent DHCPv6 injection needs no web auth (PR:N) but admin must view the page (UI:R); XSS runs in the admin session across a scope boundary (S:C) enabling full router-panel compromise (C:H/I:H, A:N).

3.1 AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 12:47 vuln.today

DescriptionCVE.org

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

AnalysisAI

Stored cross-site scripting in OpenWrt's LuCI web interface lets an adjacent-network attacker inject executable HTML/JavaScript by supplying a malicious DHCPv6 Client FQDN hostname, which the DHCP lease status tables render without proper output encoding. When an administrator views the DHCP lease page, the payload executes in their authenticated browser session, enabling router admin-panel compromise. Rated CVSS 4.0 9.4 (Critical) by the vendor; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

LuCI is the Lua-based web administration UI shipped by default with OpenWrt, the dominant open-source firmware for consumer and embedded routers. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored XSS: hostname values learned from DHCPv6 leases - specifically the Client FQDN option (RFC 4704) advertised by a client - are persisted by the DHCP/odhcpd subsystem and later echoed into the status-page HTML tables without HTML-entity encoding. Because the injected data traverses a network protocol (DHCPv6 over link-local IPv6) rather than a form field, the attacker never authenticates to the web UI; the sink is the administrator's browser. The affected component is identified by CPE cpe:2.3:a:openwrt:luci across unspecified versions.

RemediationAI

Upgrade LuCI to the fixed release identified in the OpenWrt advisory GHSA-686p-p8p9-x6fh (https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh); an exact patched version number is not present in the supplied data, so treat this as Patch available per vendor advisory and confirm the target version from that advisory before deploying (via the LuCI 'Software' page or opkg update/upgrade of the luci packages). Until patched, reduce exposure by restricting the LuCI admin interface to trusted management VLANs/hosts and avoiding administration from browsers that also handle untrusted content; on segments where DHCPv6 is not needed you can disable the DHCPv6/odhcpd server (dnsmasq/odhcpd 'dhcpv6' option) to remove the injection source, at the cost of losing stateful IPv6 address assignment. As a lower-impact interim step, administrators can avoid or minimize viewing the DHCP lease status page from an authenticated session, since exploitation only fires on page render.