luci-app-https-dns-proxy CVE-2026-67352

The luci-app-https-dns-proxy optional package must be installed on the OpenWrt device - it is not present in default OpenWrt builds. The attacker must hold a high-privilege authenticated LuCI session (PR:H) with permission to write the HTTPS DNS Proxy configuration. The stored payload only executes when an administrator actively navigates to the HTTPS DNS Proxy status page. LuCI is bound to the device's local or adjacent network interface (AV:A), so exploitation is limited to attackers already on the same network segment, management VLAN, or with local device access. Exploitation is further constrained by OpenWrt's typical single-admin model - in most home deployments there is only one admin user, meaning an attacker who can inject must already be that admin, reducing the privilege-escalation impact; the risk is higher in shared-access or multi-user LuCI deployments.

The CVSS 4.0 score of 6.8 reflects a moderate real-world threat profile. AV:A (adjacent network) is the dominant risk limiter - LuCI is bound to the device's local/management interface in standard OpenWrt deployments, preventing internet-facing exploitation. PR:H confirms that the attacker must already hold a high-privilege authenticated session to inject the payload, which substantially narrows the threat actor population. The VC:H impact rating is warranted because successful execution in the admin browser context can exfiltrate session tokens, enabling full device takeover. No EPSS data was provided, no CISA KEV listing exists, and no POC code is confirmed - these signals collectively suggest no active widespread exploitation. The stored persistence mechanism elevates this above a typical reflected-XSS finding: once injected, the payload fires on every admin page visit without further attacker involvement. Real-world priority is moderate - primarily relevant in multi-user LuCI deployments or scenarios where device access credentials may be shared or compromised.

An attacker with high-privilege access to LuCI - for example, a shared-credentials scenario or a compromised admin account - navigates to the HTTPS DNS Proxy configuration page and submits a resolver_url value containing an embedded JavaScript payload such as a script that beacons session cookies to an external host. The payload is persisted in the device configuration. Subsequently, any other administrator who loads the HTTPS DNS Proxy status page has the script silently execute in their browser origin, allowing session token exfiltration and enabling the attacker to assume full administrative control of the OpenWrt device. No public POC was confirmed at time of analysis.