OpenWrt LuCI CVE-2026-61876

Exploitation requires the attacker to be on the same adjacent/link-local network as the target OpenWrt router (AV:A) and to be able to obtain a DHCPv6 lease - i.e., the router must have the DHCPv6 server (odhcpd) enabled and accept the client's FQDN hostname option, which is default behavior on OpenWrt LAN interfaces. The payload only triggers when an authenticated administrator opens the DHCP lease status page in LuCI (UI:P/UI:R), so it is not zero-click. Limiting factors: no direct internet-facing exploitation (adjacency required), dependence on an admin viewing the specific status page, and reliance on DHCPv6 being active on the attacker-reachable segment; networks that isolate management or disable DHCPv6 on untrusted segments materially reduce risk. No web-UI authentication is needed by the attacker to inject the payload (PR:N).

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H with subsequent-system impact SC:H/SI:H/SA:H) drives the 9.4 Critical score, largely because 4.0 models the scope change into the admin's browser/router as high subsequent-system impact. Two signals temper this: the vector is Adjacent (AV:A), so the attacker must already be on the same layer-2/link-local network segment as the target router (e.g., a guest, Wi-Fi, or LAN client), and exploitation requires passive user interaction (UI:P) - an admin must actually open the DHCP lease page. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation pressure is currently unquantified. This is a genuine priority for exposed/multi-tenant networks but is not a remote, internet-wide, zero-click issue; the raw 9.4 overstates risk for single-admin home routers where the attacker cannot reach the LAN. Note the score reflects vendor SSVC-style impact weighting rather than observed exploitation.

An attacker connected to the router's LAN or Wi-Fi (including a guest network) sends a crafted DHCPv6 solicit/request carrying a Client FQDN option whose hostname embeds a script payload such as <script>...</script>. The malicious hostname is stored in the lease table, and when the router administrator later opens the DHCP/DHCPv6 leases status page in LuCI, the script executes in their authenticated session - allowing session/credential theft or CSRF-style configuration changes to the router. No public exploit code was identified at time of analysis, though the technique is straightforward given the described conditions.