What is the CVSS score of CVE-2026-62948?

CVE-2026-62948 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of OpenWrt odhcpd are affected by CVE-2026-62948?

OpenWrt routers running versions prior to 25.12.5 contain a critical vulnerability (CVSS 9.6) that allows attackers with network access to inject malicious code into administrator interfaces,…. A patch is available.

How to fix or mitigate CVE-2026-62948?

Within 24 hours, inventory all OpenWrt deployments and identify systems running versions prior to 25.12.5. Within 7 days, validate OpenWrt 25.12.5 in a non-production environment to ensure compatibility with your network configuration, then establish a staged rollout plan. Within 30 days, deploy OpenWrt 25.12.5 to all affected routers, prioritizing internet-facing and administrative access points.

OpenWrt odhcpd CVE-2026-62948

EUVD-2026-44748 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 GitHub_M

XSS Openwrt

9.6

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

DHCP is link-local so AV:A over NVD's AV:N; unauthenticated client (PR:N) but admin must view the leases page (UI:R); XSS in admin session crosses scope (S:C) enabling full router config C/I/A.

3.1 AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 21:18 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 18:34 vuln.today

Analysis Generated

Jul 15, 2026 - 18:34 vuln.today

CVE Published

Jul 15, 2026 - 17:50 cve.org

CRITICAL 9.6

DescriptionCVE.org

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

AnalysisAI

Stored cross-site scripting in OpenWrt's default odhcpd server (all releases prior to 25.12.5) lets a network-adjacent DHCP client inject forged lease records that execute as HTML/JavaScript in a router administrator's browser. The client-supplied DHCPv6 FQDN option 39 (and DHCPv4 option 12) hostname is written unescaped into /tmp/odhcpd.leases, enabling newline injection of attacker-controlled fields that LuCI's Active DHCPv6 Leases page renders via unsafe dom.append. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; it is fixed in 25.12.5.

Technical ContextAI

The vulnerability spans two components. In odhcpd (the combined DHCPv6/DHCPv4/RA server enabled by default on OpenWrt), src/statefiles.c functions statefiles_write_state6() and statefiles_write_state4() serialize each lease as a space-delimited, line-based record into /tmp/odhcpd.leases. Because DNS labels may legally carry arbitrary octets (RFC 2181 §11) and the option parser copies bytes verbatim, an attacker-controlled hostname could embed a newline (forging an extra lease line) or a space (forging additional fields). On the display side, LuCI rpcd-mod-luci getDHCPLeases feeds these fields into 40_dhcp.js, which used dom.append (luci.js) to insert the host and vendor strings as live DOM nodes without the '%h' HTML-escaping format specifier. This is a classic CWE-79 stored/persistent XSS: untrusted input crosses a trust boundary from an unauthenticated network client into an authenticated admin web context. The fix escapes non-LDH hostname bytes as \xNN in odhcpd and applies '%h'.format() on the host/vendor fields in LuCI.

RemediationAI

Vendor-released patch: OpenWrt 25.12.5 - upgrade firmware via the OpenWrt Firmware Selector (https://firmware-selector.openwrt.org/?version=25.12.5) or the release page (https://github.com/openwrt/openwrt/releases/tag/v25.12.5), which also bundles fixes for several other odhcpd CVEs (CVE-2026-53921, -53918, -53920, -53922, -55606). If you cannot immediately flash new firmware, cherry-pick the odhcpd fix (PR #404, adding statefiles_escape_hostname) and the LuCI '%h'.format() escaping commit (55379d04). As compensating controls until patched: avoid opening the LuCI Status → Active DHCP Leases page (the sink that triggers execution), since the payload only fires on admin view; restrict which hosts can obtain leases by binding odhcpd/dnsmasq to trusted VLANs and enforcing L2 segmentation so untrusted clients cannot register hostnames; and limit LuCI admin access to a management network. Note the trade-off: not viewing the leases page reduces operational visibility, and segmenting DHCP clients may break flat-network device discovery.