Vulnerability · Published Jul 12, 2026 · Assigned by VulnCheck
CVE-2026-61876LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
High 8.8
In plain English
A high-severity cross-site scripting in luci from openwrt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.6%top 23.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-686p-p8p9-x6fh) vendor-advisory
- VulnCheck Advisory: LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting third-party-advisory