luci-app-https-dns-proxy CVE-2026-67352

Q: What is the CVSS score of CVE-2026-67352?

CVE-2026-67352 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-51867 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-01 VulnCheck

GHSA-8ggv-vmgf-36wq

XSS Luci

6.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Adjacent vector reflects LuCI's local-network binding; UI:R because an admin must load the status page; S:C and I:L for cross-origin JS execution enabling admin actions.

3.1 AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 01, 2026 - 13:33 vuln.today

DescriptionCVE.org

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.

AnalysisAI

Stored cross-site scripting in luci-app-https-dns-proxy allows a highly privileged but potentially lower-trust authenticated LuCI user to persist a malicious JavaScript payload via the resolver_url parameter, which then silently executes in any administrator's browser when the HTTPS DNS Proxy status page is loaded. All currently tracked LuCI versions appear affected per EUVD listing (luci 0 <*). No public exploit code or CISA KEV listing is confirmed at time of analysis, though the stored nature of this XSS makes it more dangerous than a reflected variant because no additional attacker interaction is needed after initial injection.

Technical ContextAI

luci-app-https-dns-proxy is an optional add-on package for the LuCI web interface framework on OpenWrt, providing a graphical configuration front-end for DNS-over-HTTPS proxy daemons. The vulnerability maps to CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the resolver_url value submitted via the configuration form is stored without sanitization and later interpolated directly as raw HTML into the status page template. CPE cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:* identifies the entire OpenWrt LuCI package family as the affected software base. When the admin's browser parses the status page, the injected payload executes within the LuCI application's origin, granting it access to cookies, local storage, and the ability to issue authenticated LuCI API calls on the admin's behalf.

RemediationAI

Apply the fix referenced in GitHub Security Advisory GHSA-c6vf-395q-4jv6 at https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6; an exact patched release version was not confirmed in the provided data so administrators should monitor the advisory for a specific version number. As an immediate compensating control, restrict LuCI administrative access to a dedicated management VLAN or trusted interface, preventing untrusted or shared-credential users from reaching the DNS proxy configuration page - this directly limits the pool of attackers who can inject the payload. Additionally, audit existing resolver_url values in the device configuration for unexpected JavaScript or HTML content. Avoid granting LuCI access to users who do not require full administrative trust, as PR:H access is the prerequisite for exploitation.