EUVD-2026-51993
GHSA-vh6j-2jxw-848c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible stored XSS requires low-privileged account (PR:L) and admin page visit (UI:R); scope changes (S:C) because payload executes in admin browser context with LuCI origin access.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator views the AdBlock Fast status page, the injected payload executes in the administrator's browser under the LuCI origin.
AnalysisAI
Stored cross-site scripting in luci-app-adblock-fast before 1.2.4-4 allows a lower-privileged LuCI user to inject malicious JavaScript into the blocklist name field, which executes in an administrator's browser under the LuCI origin when the AdBlock Fast status page is viewed. Because the payload runs within the LuCI same-origin context, a successful attack could enable session hijacking, unauthorized router reconfiguration, or privilege escalation from low-privileged user to effective admin control. No public exploit is identified at time of analysis; a vendor patch is available via the GitHub Security Advisory GHSA-q335-4c83-c88h.
Technical ContextAI
LuCI is the standard web administration interface for OpenWrt-based routers and embedded Linux devices. The affected component, luci-app-adblock-fast, is a LuCI plugin managing ad-blocking rules via blocklist configurations. CWE-79 (Improper Neutralization of Input During Web Page Generation) describes the root cause: user-supplied input in the blocklist name field is stored without sanitization and later rendered into the admin status page without output encoding, allowing active HTML and JavaScript injection. The CPE cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:* confirms the vulnerability spans all LuCI versions shipping luci-app-adblock-fast prior to 1.2.4-4. The attack surface is the LuCI HTTP interface, typically exposed on the router's LAN-side network.
RemediationAI
Upgrade luci-app-adblock-fast to version 1.2.4-4 or later, which contains the vendor-confirmed fix per the GitHub Security Advisory at https://github.com/openwrt/luci/security/advisories/GHSA-q335-4c83-c88h. On OpenWrt devices, this can typically be performed via opkg: run 'opkg update && opkg upgrade luci-app-adblock-fast'. If immediate patching is not possible, restrict LuCI access to the minimum required accounts - remove or disable any lower-privileged user accounts that do not require access to the blocklist configuration, since the attack requires an authenticated low-privileged session. As an additional compensating control, restrict the LuCI interface to trusted LAN segments or VPN-only access to limit the pool of potential attackers. Before patching, audit existing blocklist name entries for suspicious script tags or encoded payloads and remove any anomalies.
In wlan service, there is a possible out of bounds write due to improper input validation. Rated critical severity (CVSS
An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0, and LEDE 17.01.0 to 17.01.7. Rated high severity (CVS
An issue was discovered in OpenWrt libuci (aka Library for the Unified Configuration Interface) before 15.05.1 as used o
cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the
In wlan service, there is a possible out of bounds write due to an incorrect bounds check. Rated critical severity (CVSS
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1
Remote privilege escalation in Android WLAN AP driver via packet injection.
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es
Remote code execution in OpenWrt's mDNS daemon (versions before 24.10.6 and 25.12.1) allows unauthenticated attackers to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today