Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

169 records

Vendor: openwrt Clear all filters
TI-2026-79901 CVE-2026-53918

Use-after-free in odhcpd DHCPv6 IA handling

Priority HIGH 77

odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00619 Published 2026-10-23 Fixed in 25.12 CWE-416
TI-2026-44521 CVE-2026-62381 · GHSA-g4fj-xr23-w9hm

luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

Priority MEDIUM 64

luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 2040-bit RSA key.

CVSS 4.0MEDIUM 6.9 Local Low privileges No interaction EPSS 0.00108 Published 2026-08-22 No fix listed CWE-122
TI-2026-51068 CVE-2026-72842 · GHSA-q7c4-ghwq-63xh

OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

Priority MEDIUM 43

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00616 Published 2026-08-13 No fix listed CWE-73
TI-2026-51067 CVE-2026-72841 · GHSA-x5wv-6f33-ph3p

luci-app-openvpn Path Traversal RCE via instance_name2

Priority HIGH 76

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00616 Published 2026-08-13 Fixed in 24.10.7, 25.12.4 CWE-73
TI-2026-51066 CVE-2026-72840 · GHSA-6vfc-74mf-qrmj

OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write

Priority HIGH 73

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00442 Published 2026-08-13 No fix listed CWE-266
TI-2026-48503 CVE-2026-69096 · GHSA-wjfh-jfr9-fxvm

OpenWrt luci-app-dockerman Read ACL Remote Code Execution

Priority MEDIUM 45

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0327 Published 2026-08-03 No fix listed CWE-78
TI-2026-48502 CVE-2026-69095 · GHSA-4q7q-8m76-5rv8

OpenWrt luci-app-bmx7 Path Traversal via bmx7-info

Priority HIGH 77

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00928 Published 2026-08-03 Fixed CWE-22
TI-2026-48323 CVE-2026-68583 · GHSA-vh6j-2jxw-848c

luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name

Priority MEDIUM 56

luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00235 Published 2026-08-02 Fixed in 1.2.4-4 CWE-79
TI-2026-47648 CVE-2026-67352 · GHSA-8ggv-vmgf-36wq

luci-app-https-dns-proxy Stored XSS via resolver_url

Priority LOW 30

luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML.

CVSS 4.0MEDIUM 6.8 Adjacent network High privileges No interaction EPSS 0.00407 Published 2026-08-01 No fix listed CWE-79
TI-2026-44983 CVE-2026-62948

Cross-site scripting in openwrt

Priority HIGH 76

OpenWrt is a Linux operating system targeting embedded devices.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.0058 Published 2026-07-15 Fixed in 25.12.5 CWE-117
TI-2026-44407 CVE-2026-62184 · GHSA-2532-qx65-h9m6

luci-app-banip Log Monitor IP Extraction Bypass

Priority HIGH 77

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controll…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00556 Published 2026-07-13 Fixed CWE-116
TI-2026-44280 CVE-2026-61876 · GHSA-8gvq-r3c7-vwmv

LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

Priority HIGH 76

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup.

CVSS 4.0CRITICAL 9.4 Adjacent network No auth User interaction EPSS 0.01621 Published 2026-07-12 No fix listed CWE-79
TI-2026-44279 CVE-2026-61875 · GHSA-xwgp-pprm-vcx3

luci-app-upnp Stored XSS via UPnP Port Mapping Description

Priority HIGH 73

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests.

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00358 Published 2026-07-12 Fixed in 24.10.8, 25.12.5 CWE-79
TI-2026-42400 CVE-2026-59260 · GHSA-7pqv-wj3v-fcq3

OpenWrt luci-app-samba4 read ACL remote code execution via smbd

Priority HIGH 73

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00875 Published 2026-07-12 Fixed in 24.10.8, 25.12.5 CWE-269
Load more