OpenWrt odhcpd CVE-2026-62948

Requires odhcpd running as the DHCPv6/DHCPv4 server, which is the default OpenWrt configuration, and an attacker able to send DHCP requests on the local link with a crafted FQDN option 39 / option 12 hostname carrying an embedded newline plus HTML/JS. Critically, the payload only executes when an authenticated administrator opens the LuCI Status → Active DHCPv6 Leases (or DHCPv4 leases) admin page (UI:R) - it does not fire autonomously. Limiting factors: the attacker must be network-adjacent to the DHCP segment (DHCP is link-local, not routable Internet-wide), and no exploitation occurs without an admin viewing the affected LuCI page, so this is opportunistic rather than automatable.

The NVD CVSS 3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting an unauthenticated injector, scope change into the admin session, and full C/I/A impact on a router. However, several signals temper the raw score. First, the attack vector is realistically network-adjacent rather than truly remote: DHCPv6/DHCPv4 exchanges occur on the local link, so the attacker generally needs L2 access to the DHCP segment (AV:A is a more defensible metric than AV:N - verify against your deployment topology). Second, UI:R is a genuine gate - exploitation only fires when an administrator opens the LuCI leases status page, making this opportunistic rather than automatable. There is no EPSS score, no KEV listing, and no POC in the provided data, so this is a high-severity-by-construction issue without evidence of active exploitation. Given XSS in a router admin panel can pivot to full device configuration changes, it remains a real patch priority for exposed or multi-tenant LAN environments, but it is not a wormable internet-facing RCE.

An attacker with access to the LAN/DHCP link connects a device that requests a lease with a crafted DHCPv6 FQDN option 39 (or DHCPv4 option 12) hostname containing an embedded newline and an HTML/JavaScript payload. odhcpd writes the forged line into /tmp/odhcpd.leases, and when the router administrator later opens the LuCI Active DHCPv6 Leases page, the payload executes in their authenticated session, allowing router configuration changes. No public POC is identified at time of analysis; the network-adjacent vector plus required admin page view (UI:R) make this opportunistic.