Luci-App-Upnp - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/luci-app-upnp/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 12 Jul 2026 12:25:52 +0000CVE-2026-61875: Stored Cross-Site Scripting in OpenWrt luci-app-upnphttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-61875-luci-app-upnp-xss/Sun, 12 Jul 2026 12:25:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-61875-luci-app-upnp-xss/CVE-2026-61875 details a stored cross-site scripting vulnerability in OpenWrt's luci-app-upnp that allows unauthenticated LAN clients to inject malicious JavaScript into UPnP IGD AddPortMapping SOAP requests, leading to client-side code execution in an administrator's browser when viewing specific web interface pages.CVE-2026-61875 identifies a critical stored cross-site scripting (XSS) vulnerability within luci-app-upnp, a component of OpenWrt, an embedded operating system primarily used on routers. This vulnerability allows unauthenticated clients on the local area network (LAN) to inject arbitrary JavaScript code. The attack vector involves crafting a malicious UPnP IGD AddPortMapping SOAP request and embedding the JavaScript payload within the NewPortMappingDescription field. The miniupnpd daemon, responsible for handling UPnP requests, stores this malicious HTML without proper output encoding. Subsequently, when an administrator accesses the luci-app-upnp web interface and navigates to the UPnP or Status pages, the stored payload is rendered in their browser, executing the injected script. This flaw could lead to various client-side attacks, including session hijacking, credential theft, or further compromise of the administrator's system.

Attack Chain

  1. An unauthenticated client gains access to the local area network (LAN) segment where the OpenWrt device is located.
  2. The client crafts a specially designed UPnP IGD AddPortMapping SOAP request.
  3. The malicious JavaScript payload is embedded within the NewPortMappingDescription field of the SOAP request.
  4. The client sends the crafted SOAP request to the OpenWrt device's UPnP service, handled by the miniupnpd daemon.
  5. The miniupnpd daemon processes the request and stores the malicious HTML content in its configuration or data store without sanitization.
  6. An administrator logs into the OpenWrt web interface (luci-app-upnp).
  7. The administrator navigates to the UPnP or Status pages, which display information including the stored port mapping descriptions.
  8. The luci-app-upnp interface renders the stored malicious HTML directly in the administrator's web browser, executing the embedded JavaScript.

Impact

A successful exploitation of CVE-2026-61875 grants attackers the ability to execute arbitrary client-side code within the context of an administrator's browser session. This can lead to severe consequences, such as session hijacking, allowing the attacker to take over the administrator's web session, perform actions as the administrator, or steal authentication cookies. It could also facilitate credential theft through phishing techniques, browser-based cryptocurrency mining, or redirecting administrators to malicious websites. While specific victim counts are not available, OpenWrt is widely deployed on consumer and small office/home office (SOHO) routers, making a large number of devices potentially vulnerable to unauthenticated LAN-side compromise.

Recommendation

  • Patch CVE-2026-61875 by updating OpenWrt luci-app-upnp to the latest version as recommended by OpenWrt to address the cross-site scripting vulnerability.
  • Monitor network traffic for unusual UPnP IGD AddPortMapping SOAP requests, particularly those with unusually long or HTML-like content in the NewPortMappingDescription field, which could indicate attempts to exploit CVE-2026-61875.
]]>highadvisorycross-site-scriptingxssopenwrtrouterweb-vulnerabilityclient-side-execution