https://feed.craftedsignal.io/tags/openwrt/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 12 Jul 2026 12:25:52 +0000https://feed.craftedsignal.io/briefs/2026-07-cve-2026-61875-luci-app-upnp-xss/Sun, 12 Jul 2026 12:25:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-61875-luci-app-upnp-xss/CVE-2026-61875 details a stored cross-site scripting vulnerability in OpenWrt's luci-app-upnp that allows unauthenticated LAN clients to inject malicious JavaScript into UPnP IGD AddPortMapping SOAP requests, leading to client-side code execution in an administrator's browser when viewing specific web interface pages.CVE-2026-61875 identifies a critical stored cross-site scripting (XSS) vulnerability within luci-app-upnp, a component of OpenWrt, an embedded operating system primarily used on routers. This vulnerability allows unauthenticated clients on the local area network (LAN) to inject arbitrary JavaScript code. The attack vector involves crafting a malicious UPnP IGD AddPortMapping SOAP request and embedding the JavaScript payload within the NewPortMappingDescription field. The miniupnpd daemon, responsible for handling UPnP requests, stores this malicious HTML without proper output encoding. Subsequently, when an administrator accesses the luci-app-upnp web interface and navigates to the UPnP or Status pages, the stored payload is rendered in their browser, executing the injected script. This flaw could lead to various client-side attacks, including session hijacking, credential theft, or further compromise of the administrator's system.

Attack Chain

1. An unauthenticated client gains access to the local area network (LAN) segment where the OpenWrt device is located.
2. The client crafts a specially designed UPnP IGD AddPortMapping SOAP request.
3. The malicious JavaScript payload is embedded within the NewPortMappingDescription field of the SOAP request.
4. The client sends the crafted SOAP request to the OpenWrt device's UPnP service, handled by the miniupnpd daemon.
5. The miniupnpd daemon processes the request and stores the malicious HTML content in its configuration or data store without sanitization.
6. An administrator logs into the OpenWrt web interface (luci-app-upnp).
7. The administrator navigates to the UPnP or Status pages, which display information including the stored port mapping descriptions.
8. The luci-app-upnp interface renders the stored malicious HTML directly in the administrator's web browser, executing the embedded JavaScript.

Impact

A successful exploitation of CVE-2026-61875 grants attackers the ability to execute arbitrary client-side code within the context of an administrator's browser session. This can lead to severe consequences, such as session hijacking, allowing the attacker to take over the administrator's web session, perform actions as the administrator, or steal authentication cookies. It could also facilitate credential theft through phishing techniques, browser-based cryptocurrency mining, or redirecting administrators to malicious websites. While specific victim counts are not available, OpenWrt is widely deployed on consumer and small office/home office (SOHO) routers, making a large number of devices potentially vulnerable to unauthenticated LAN-side compromise.

Recommendation

• Patch CVE-2026-61875 by updating OpenWrt luci-app-upnp to the latest version as recommended by OpenWrt to address the cross-site scripting vulnerability.
• Monitor network traffic for unusual UPnP IGD AddPortMapping SOAP requests, particularly those with unusually long or HTML-like content in the NewPortMappingDescription field, which could indicate attempts to exploit CVE-2026-61875.

]]>highadvisorycross-site-scriptingxssopenwrtrouterweb-vulnerabilityclient-side-executionhttps://feed.craftedsignal.io/briefs/2026-07-openwrt-samba4-rce/Sun, 12 Jul 2026 12:25:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-openwrt-samba4-rce/A vulnerability in OpenWrt's luci-app-samba4, identified as CVE-2026-59260, allows authenticated delegated users to achieve remote command execution on the Samba daemon by leveraging improper ACLs that grant `file.exec` permission on `/usr/sbin/smbd`.A high-severity vulnerability, CVE-2026-59260, has been identified in OpenWrt's luci-app-samba4 package, which serves as a web interface for Samba. This flaw stems from an improper read ACL that inadvertently grants file.exec permission on the /usr/sbin/smbd daemon. This misconfiguration allows authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can leverage this by passing arbitrary Samba global options, such as the message command parameter, to a root smbd process. This injection ultimately triggers command execution on the underlying OpenWrt device when SMB protocol messages are processed, leading to remote code execution. This vulnerability poses a significant risk to OpenWrt systems using the vulnerable package, enabling attackers to gain full control over the device.

Attack Chain

1. An attacker obtains credentials for an authenticated delegated user on an OpenWrt device running luci-app-samba4.
2. The attacker leverages the improper read ACL within luci-app-samba4 that affects the /usr/sbin/smbd executable.
3. The misconfigured ACL grants the authenticated user file.exec permission on the /usr/sbin/smbd daemon, allowing them to initiate its execution.
4. The attacker executes the /usr/sbin/smbd process, providing specific command-line arguments that are under their control.
5. During the execution, the attacker injects malicious Samba global options, such as -o "message command = /path/to/arbitrary/script.sh", into the smbd process.
6. The smbd process, running with root privileges, processes subsequent SMB protocol messages containing the injected message command.
7. The arbitrary command specified in the message command option is then executed with root privileges on the OpenWrt device.
8. The attacker achieves remote code execution (RCE), gaining full control over the compromised OpenWrt system.

Impact

Successful exploitation of CVE-2026-59260 allows an authenticated delegated user to achieve remote code execution with root privileges on the OpenWrt device. This level of compromise grants the attacker complete control over the network device. The impact includes, but is not limited to, unauthorized access to network resources, manipulation or exfiltration of sensitive data, establishment of persistent backdoors, and the ability to pivot to other systems within the network. This could lead to significant data breaches, service disruptions, or further attacks on connected infrastructure.

Recommendation

• Patch CVE-2026-59260 by updating the luci-app-samba4 package on all affected OpenWrt devices immediately.
• Deploy the Sigma rule provided in this brief to your SIEM to detect suspicious smbd process creations.
• Enable comprehensive process creation logging for Linux systems to capture full command-line arguments for processes like smbd.

]]>highadvisoryopenwrtsambacvercenetworklinux