OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute.

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process.

In the Linux kernel, the following vulnerability has been resolved:

batman-adv: bla: avoid double decrement of bla.numrequests

The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places (announcement was received, backbone is purged, periodic work). But the check if the requestsent is actually set to a specific state and the atomicdec/inc are not safe because they are not atomic (TOCTOU) and multiple such code portions can run concurrently.

At the same time, it is necessary to modify requestsent (state) and bla.numrequests atomically. Otherwise batadvblasendrequest() might set requestsent to 1 and is interrupted. batadvhandleannounce() can then set requestsent back to 0 and decrement numrequests before batadvblasendrequest() incremented it.

The two operations must therefore be locked. And since state (requestsent) and waitperiods are only accessed inside this lock, they can be converted to simpler datatypes. And to avoid that the bla.numrequests is touched by a parallel running context with a valid backbonegw reference after batadvblapurgebackbonegw() ran, a third state "stopped" is required to correctly signal that a backbonegw is in the state of being cleaned up.

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNMPATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vulnerability is fixed in 25.12.5.

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6() and statefileswritestate4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handlesenda() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5.

On Thu, 11 Jun 2026, 01:41 Hauke Mehrtens, <hauke () hauke-m de> wrote: On 6/10/26 16:14, Lucas Holt wrote: On 6/10/26 8:52 AM, Christian Brabandt wrote: Agree, but they seemed to be swamped by CVE requests for the last couple of months. I have been waiting for up to 3 weeks on the final CVE assignment. I've also had delays getting them, but consider all the AI related reports. We submitted 13 requests for mport package manager recently.

Lucas Holt Luke () FoolishGames com MidnightBSD.org (Free OS) JustJournal.com (Free blogging) Thank you all for the help.

We requested CVE numbers on github about 1 week ago here: https://github.com/openwrt/odhcpd/security/advisories/

We will probably patch the vulnerabilities and also publish them before we have CVE numbers assigned and just update the advisory later. Hello Hauke, I'm operating a CNA (Ygreky) that can assign to projects that do not have any other. Contact vulns () ygreky com if interested. No fees or any conditions for open source.

Kind regards, Marta

On 6/10/26 16:14, Lucas Holt wrote: On 6/10/26 8:52 AM, Christian Brabandt wrote: Agree, but they seemed to be swamped by CVE requests for the last couple of months. I have been waiting for up to 3 weeks on the final CVE assignment. Lucas Holt Luke () FoolishGames com MidnightBSD.org (Free OS) JustJournal.com (Free blogging) Thank you all for the help.

We requested CVE numbers on github about 1 week ago here: https://github.com/openwrt/odhcpd/security/advisories/ Hauke

They did say they already requested CVEs that way.

I just asked some Github staff about the current situation, and apparently May was the highest volume month ever. So, there's a backlog they're trying to work through and catch up.

Someone also pointed me to this guide if you wanted to become a CNA yourself: https://sethmlarson.dev/security-developer-in-residence-weekly-report-17#becoming-a-cve-numbering-authority-as-an-open-source-project

Hopefully the Github team will catch up soon and get back to their usual timeliness.

- Sam

On Wed, 2026-06-10 at 11:27 +0000, Marcus Meissner wrote: Hi,

I concur, if you use github, its easiest workflow wise to use the Github Security Advisories and their CVE allocation ability.

Ciao, Marcus On Wed, Jun 10, 2026 at 05:36:03PM +0800, swing sze wrote: HI,

https://github.com/openwrt/odhcpd/security

Are you using the GitHub Security Advisor feature to submit CVEs?

Hauke Mehrtens <hauke () hauke-m de> 于2026年6月10日周三 16:59写道： Hi,

How to get a CVE number as a community driven open source project (OpenWrt)? We do not have a security department or a big company backing us.

Multiple security problems were reported to OpenWrt in the last few months. We want to assign CVE numbers to these problems, but have problems requesting numbers.

We contacted mitre in the past, but did not got a response within 2 weeks. Using github security advisories worked fine 2 months ago, we got a CVE number in some days. Currently this does not work any more, we are already waiting for 1 week.

How to get a CVE number?

We (OpenWrt) are a community driven open source project and got multiple reports from individuals and organizations like OpenAI.

We requested multiple CVE Numbers on github for this project: https://github.com/openwrt/odhcpd

Hauke

You can try VulnCheck — https://www.vulncheck.com/advisories/report On Jun 9, 2026, at 3:32 PM, Hauke Mehrtens <hauke () hauke-m de> wrote:

Hi,

How to get a CVE number as a community driven open source project (OpenWrt)? We do not have a security department or a big company backing us.

Multiple security problems were reported to OpenWrt in the last few months. We want to assign CVE numbers to these problems, but have problems requesting numbers.

We contacted mitre in the past, but did not got a response within 2 weeks. Using github security advisories worked fine 2 months ago, we got a CVE number in some days. Currently this does not work any more, we are already waiting for 1 week.

How to get a CVE number?

We (OpenWrt) are a community driven open source project and got multiple reports from individuals and organizations like OpenAI.

We requested multiple CVE Numbers on github for this project: https://github.com/openwrt/odhcpd

Hauke

LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an attacker to craft a malicious SSID containing arbitrary HTML/JavaScript. Exploitation requires the user to actively open the wireless scan modal (e.g., to connect to a Wi-Fi access point or survey nearby channels), and only affects OpenWrt versions newer than 23.05/22.03 up to the patched releases (24.10.6 and 25.12.1). The issue has been fixed in version LuCI 26.072.65753~068150b.

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplugcall function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scripts in /etc/hotplug.d, but a bug using strcmp instead of strncmp causes the filter to compare the full environment string (e.g., PATH=/some/value) against the literal "PATH", so the match always fails. As a result, the PATH variable is never excluded, enabling an attacker to control which binaries are executed by procd-invoked scripts running with elevated privileges. This issue has been fixed in version 24.10.6.

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jpgettoken function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in a jpopcode struct, which is later copied to a newly allocated jpopcode object via jpallocop. During this transfer, if a string was previously extracted and stored in the initial jpopcode, it is copied to the new allocation but the original memory is never freed, resulting in a memory leak. This issue has been fixed in versions 24.10.6 and 25.12.1.

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the matchipv6addresses function, triggered when processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. During processing, the domain name from namebuffer is copied via strcpy into a fixed 256-byte stack buffer, and then the reverse IPv6 request is extracted into a buffer of only 46 bytes (INET6ADDRSTRLEN). Because the length of the data is never validated before this extraction, an attacker can supply input larger than 46 bytes, causing an out-of-bounds write. This allows a specially crafted DNS query to overflow the stack buffer in matchipv6addresses, potentially enabling remote code execution. This issue has been fixed in versions 24.10.6 and 25.12.1.

OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parsequestion function. The issue is triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dnexpand into an 8096-byte global buffer (namebuffer), which is then copied via an unbounded strcpy into a fixed 256-byte stack buffer when handling TYPEPTR queries. The overflow is possible because dnexpand converts non-printable ASCII bytes (e.g., 0x01) into multi-character octal representations (e.g., \001), significantly inflating the expanded name beyond the stack buffer's capacity. A crafted DNS packet can exploit this expansion behavior to overflow the stack buffer, making the vulnerability reachable through normal multicast DNS packet processing. This issue has been fixed in versions 24.10.6 and 25.12.1.

Latest version: 25.12.5

In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118.

In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00467553; Issue ID: MSV-5151.

In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461663 / WCNCR00463309; Issue ID: MSV-4852.

In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758.

In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432679; Issue ID: MSV-3950.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00434422; Issue ID: MSV-3958.

In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966.

In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435340; Issue ID: MSV-4038.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435342; Issue ID: MSV-4039.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435347; Issue ID: MSV-4049.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00441507; Issue ID: MSV-4112.

In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID: WCNCR00441510; Issue ID: MSV-4139.