OpenWrt - CraftedSignal Threat Feed

LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting Vulnerability (CVE-2026-61876)

hello@craftedsignal.io — Sun, 12 Jul 2026 12:26:40 +0000

CVE-2026-61876 identifies a high-severity stored Cross-Site Scripting (XSS) vulnerability affecting LuCI, the default web interface for OpenWrt-based routers and network devices. This flaw arises from LuCI's failure to properly encode DHCPv6 lease hostnames before displaying them in administrative status tables. An attacker with adjacent network access can craft a malicious DHCPv6 Client FQDN containing script tags or other HTML markup. When an administrator subsequently views the DHCPv6 lease status page within the LuCI web interface, the injected malicious code executes in their browser. This client-side code execution can lead to various compromises within the administrative session, including session hijacking, credential theft, or unauthorized actions within the LuCI interface.

Attack Chain

An attacker gains presence on the same adjacent network segment as the vulnerable LuCI-managed OpenWrt device.
The attacker crafts a DHCPv6 Client Fully Qualified Domain Name (FQDN) containing a malicious XSS payload, such as .
The attacker sends a DHCPv6 request to the OpenWrt device, including the malicious FQDN in the request.
The OpenWrt device, running the LuCI web interface, processes the DHCPv6 request and stores the malicious FQDN in its internal DHCP lease table.
An administrator logs into the LuCI web interface and navigates to the DHCPv6 lease status page to view network client information.
The LuCI web interface queries the stored DHCP lease data, retrieves the malicious FQDN, and constructs an HTML response for the administrator's browser.
Due to improper encoding, LuCI embeds the attacker's malicious FQDN directly into the HTML without sanitization.
The administrator's browser renders the page, executing the injected script within the context of the LuCI administrative interface, potentially leading to session hijacking or further compromise.

Impact

Successful exploitation of CVE-2026-61876 results in client-side code execution within an administrator's browser while they are logged into the LuCI web interface. This can lead to session hijacking, allowing the attacker to take over the administrator's session and perform actions on the OpenWrt device. Attackers could also steal credentials, deface the administrative interface, or redirect the administrator to malicious websites. Such compromise of a router's administrative interface could grant attackers control over network configuration, traffic routing, and potentially provide a foothold for further attacks against the internal network.

Recommendation

Patch CVE-2026-61876 by updating LuCI to a version that properly encodes DHCPv6 lease hostnames. Refer to the OpenWrt project's advisories for specific version updates.
Implement network segmentation to restrict DHCPv6 requests to trusted devices and prevent adjacent network attackers from reaching the router's DHCP service.
Educate administrators on the risks of XSS and suspicious behavior when interacting with web interfaces, even trusted ones.

CVE-2026-61875: Stored Cross-Site Scripting in OpenWrt luci-app-upnp

hello@craftedsignal.io — Sun, 12 Jul 2026 12:25:52 +0000

CVE-2026-61875 identifies a critical stored cross-site scripting (XSS) vulnerability within luci-app-upnp, a component of OpenWrt, an embedded operating system primarily used on routers. This vulnerability allows unauthenticated clients on the local area network (LAN) to inject arbitrary JavaScript code. The attack vector involves crafting a malicious UPnP IGD AddPortMapping SOAP request and embedding the JavaScript payload within the NewPortMappingDescription field. The miniupnpd daemon, responsible for handling UPnP requests, stores this malicious HTML without proper output encoding. Subsequently, when an administrator accesses the luci-app-upnp web interface and navigates to the UPnP or Status pages, the stored payload is rendered in their browser, executing the injected script. This flaw could lead to various client-side attacks, including session hijacking, credential theft, or further compromise of the administrator's system.

Attack Chain

An unauthenticated client gains access to the local area network (LAN) segment where the OpenWrt device is located.
The client crafts a specially designed UPnP IGD AddPortMapping SOAP request.
The malicious JavaScript payload is embedded within the NewPortMappingDescription field of the SOAP request.
The client sends the crafted SOAP request to the OpenWrt device's UPnP service, handled by the miniupnpd daemon.
The miniupnpd daemon processes the request and stores the malicious HTML content in its configuration or data store without sanitization.
An administrator logs into the OpenWrt web interface (luci-app-upnp).
The administrator navigates to the UPnP or Status pages, which display information including the stored port mapping descriptions.
The luci-app-upnp interface renders the stored malicious HTML directly in the administrator's web browser, executing the embedded JavaScript.

Impact

A successful exploitation of CVE-2026-61875 grants attackers the ability to execute arbitrary client-side code within the context of an administrator's browser session. This can lead to severe consequences, such as session hijacking, allowing the attacker to take over the administrator's web session, perform actions as the administrator, or steal authentication cookies. It could also facilitate credential theft through phishing techniques, browser-based cryptocurrency mining, or redirecting administrators to malicious websites. While specific victim counts are not available, OpenWrt is widely deployed on consumer and small office/home office (SOHO) routers, making a large number of devices potentially vulnerable to unauthenticated LAN-side compromise.

Recommendation

Patch CVE-2026-61875 by updating OpenWrt luci-app-upnp to the latest version as recommended by OpenWrt to address the cross-site scripting vulnerability.
Monitor network traffic for unusual UPnP IGD AddPortMapping SOAP requests, particularly those with unusually long or HTML-like content in the NewPortMappingDescription field, which could indicate attempts to exploit CVE-2026-61875.

OpenWrt luci-app-samba4 Vulnerability Allows Remote Command Execution

hello@craftedsignal.io — Sun, 12 Jul 2026 12:25:02 +0000

A high-severity vulnerability, CVE-2026-59260, has been identified in OpenWrt's luci-app-samba4 package, which serves as a web interface for Samba. This flaw stems from an improper read ACL that inadvertently grants file.exec permission on the /usr/sbin/smbd daemon. This misconfiguration allows authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can leverage this by passing arbitrary Samba global options, such as the message command parameter, to a root smbd process. This injection ultimately triggers command execution on the underlying OpenWrt device when SMB protocol messages are processed, leading to remote code execution. This vulnerability poses a significant risk to OpenWrt systems using the vulnerable package, enabling attackers to gain full control over the device.

Attack Chain

An attacker obtains credentials for an authenticated delegated user on an OpenWrt device running luci-app-samba4.
The attacker leverages the improper read ACL within luci-app-samba4 that affects the /usr/sbin/smbd executable.
The misconfigured ACL grants the authenticated user file.exec permission on the /usr/sbin/smbd daemon, allowing them to initiate its execution.
The attacker executes the /usr/sbin/smbd process, providing specific command-line arguments that are under their control.
During the execution, the attacker injects malicious Samba global options, such as -o "message command = /path/to/arbitrary/script.sh", into the smbd process.
The smbd process, running with root privileges, processes subsequent SMB protocol messages containing the injected message command.
The arbitrary command specified in the message command option is then executed with root privileges on the OpenWrt device.
The attacker achieves remote code execution (RCE), gaining full control over the compromised OpenWrt system.

Impact

Successful exploitation of CVE-2026-59260 allows an authenticated delegated user to achieve remote code execution with root privileges on the OpenWrt device. This level of compromise grants the attacker complete control over the network device. The impact includes, but is not limited to, unauthorized access to network resources, manipulation or exfiltration of sensitive data, establishment of persistent backdoors, and the ability to pivot to other systems within the network. This could lead to significant data breaches, service disruptions, or further attacks on connected infrastructure.

Recommendation

Patch CVE-2026-59260 by updating the luci-app-samba4 package on all affected OpenWrt devices immediately.
Deploy the Sigma rule provided in this brief to your SIEM to detect suspicious smbd process creations.
Enable comprehensive process creation logging for Linux systems to capture full command-line arguments for processes like smbd.