CVE-2026-62948: OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6() and statefileswritestate4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenWrt odhcpd/LuCIto a version that resolves this vulnerability.Fixed in 25.12.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62948?
CVE-2026-62948 has a severity score of 9.6, which is classified as critical.
How do I fix CVE-2026-62948?
To fix CVE-2026-62948, upgrade your OpenWrt installation to version 25.12.5 or later.
What type of vulnerability is CVE-2026-62948?
CVE-2026-62948 is an unauthenticated stored XSS vulnerability in the LuCI admin UI.
What impact does CVE-2026-62948 have on systems?
CVE-2026-62948 allows an attacker to inject forged lease-file lines, leading to potential XSS exploitation.
Who is affected by CVE-2026-62948?
CVE-2026-62948 affects users of OpenWrt versions prior to 25.12.5 that utilize the odhcpd DHCPv6 client.