Description Summary:
An ACL inconsistency in the OpenWrt LuCI LXC application allows authenticated users with low privileges to bypass authorization and execute arbitrary code as root on the host.

Executive Summary:
A critical authorization bypass and path traversal vulnerability in the OpenWrt LuCI LXC application allows low-privileged users to achieve root code execution on the host system.

Vulnerability Details

CVE-ID: CVE-2026-72842

Affected Software: openwrt luci

Affected Versions: openwrt luci

Vulnerability: This vulnerability, classified as CWE-73, involves an ACL inconsistency that permits path traversal via the lxc_name parameter. By escaping container directories, an authenticated user with low privileges can trigger host-side scripts, resulting in root-level code execution on the OpenWrt host.

Business Impact

The CVSS score of 9.9 highlights the extreme danger of this flaw. By allowing a low-privileged user to escalate to root-level host control, the vulnerability enables complete compromise of the network device, which can be used to intercept traffic, modify configurations, or pivot into internal network segments.

Remediation Plan

Immediate Action: Update the OpenWrt LuCI installation to the latest version as specified in the official vendor security advisory.

Proactive Monitoring: Review LuCI access logs for suspicious input sequences, specifically searching for path traversal patterns like /.%2E.

Compensating Controls: Limit administrative access to the LuCI interface to trusted management networks and strictly enforce the principle of least privilege for all user accounts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity requires authenticated access, but the impact of full host compromise makes it a high-priority concern for network administrators.

Analyst Recommendation

Given the potential for root-level host execution, this vulnerability poses a severe threat to network integrity. Administrators should consult the OpenWrt security advisory immediately to identify the correct patched version and apply the update to all affected devices.

Description Summary:
The luci-app-openvpn package for OpenWrt is vulnerable to path traversal during file uploads, enabling authenticated users to write arbitrary files and achieve root code execution.

Executive Summary:
An authenticated path traversal vulnerability in OpenWrt luci-app-openvpn allows attackers to achieve persistent root code execution on the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-72841

Affected Software: openwrt luci

Affected Versions: openwrt luci

Vulnerability: The luci-app-openvpn package fails to validate the instance_name2 parameter during file upload operations. This allows an authenticated user to perform path traversal, facilitating the placement of malicious files such as SSH keys in sensitive system directories.

Business Impact

Successful exploitation permits an authenticated attacker to gain persistent root access to the device. With a CVSS score of 9.9, the impact is catastrophic, potentially leading to full system takeover, network interception, and the compromise of all traffic passing through the affected router or gateway.

Remediation Plan

Immediate Action: Update the luci-app-openvpn package to the latest version provided by the OpenWrt project.

Proactive Monitoring: Monitor system logs for unauthorized file writes or unexpected modifications to sensitive configuration directories like /etc/ or /root/.

Compensating Controls: Restrict access to the LuCI web interface to trusted management networks only, and ensure that only highly privileged, audited users have access to the administrative dashboard.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the initial attack surface, but the resulting impact is total system compromise.

Analyst Recommendation

Administrators must prioritize updating the luci-app-openvpn package to the version that includes the necessary path validation fixes. Because this vulnerability allows for persistent root access, immediate remediation is essential to maintain the integrity of the network infrastructure.

Description Summary:
OpenWrt LuCI contains an overly permissive ACL in the system-mounts module, allowing low-privileged users to modify root crontabs for remote code execution.

Executive Summary:
A critical vulnerability in OpenWrt LuCI allows authenticated attackers with mount-configuration privileges to achieve root-level remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-72840

Affected Software: OpenWrt LuCI

Affected Versions: See vendor advisory

Vulnerability: The flaw resides in the luci-mod-system-mounts module, which incorrectly grants write access to /etc/crontabs/root. An authenticated attacker can leverage this misconfiguration to inject arbitrary cron entries via the ubus file.write function, resulting in full system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its high potential for total system compromise. By gaining root access, an attacker could exfiltrate sensitive configuration data, deploy persistence mechanisms, or pivot into the internal network, leading to significant operational disruption and loss of confidentiality.

Remediation Plan

Immediate Action: Apply the vendor security updates provided in the linked advisory immediately.

Proactive Monitoring: Review system logs for unauthorized ubus calls or suspicious changes to the /etc/crontabs/root file.

Compensating Controls: Restrict access to the LuCI web interface and audit user permissions to ensure that only trusted accounts possess mount-configuration ACL capabilities.

Exploitation Status

Public Exploit Available: Yes (per CISA's SSVC assessment, a proof-of-concept exists).

Analyst Notes: As of August 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct path from a low-privilege ACL to root command execution.

Analyst Recommendation

Given the severity of this privilege escalation flaw, administrators must prioritize patching the LuCI interface. The ability for a low-privileged user to gain root execution represents an unacceptable risk to the integrity of the network infrastructure, necessitating immediate remediation.

Description Summary:
A command injection vulnerability in the OpenWrt luci-app-dockerman package allows authenticated users to execute arbitrary OS commands.

Executive Summary:
An OS command injection vulnerability in OpenWrt LuCI permits authenticated attackers to achieve remote code execution on the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-69096

Affected Software: OpenWrt LuCI

Affected Versions: 26.162.29621~507ab5e

Vulnerability: This vulnerability involves an improper neutralization of special elements used in an OS command (CWE-78). The flaw exists within the luci-app-dockerman component and requires the attacker to hold low-level authenticated access to the interface to trigger the injection.

Business Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the LuCI process. This could lead to a complete system compromise, unauthorized data access, or the deployment of persistent backdoors on the networking device. Given the CVSS score of 8.8, this represents a significant risk to network infrastructure integrity.

Remediation Plan

Immediate Action: Update the luci-app-dockerman package to the version provided in the official OpenWrt security advisory.

Proactive Monitoring: Review system and application logs for unusual shell command executions or unexpected process spawning originating from the LuCI web interface.

Compensating Controls: Restrict administrative access to the LuCI interface to trusted management networks only to minimize the attack surface.

Exploitation Status

Public Exploit Available: No confirmed public exploit (e.g., Metasploit or ExploitDB) is identified in the provided data.

Analyst Notes: As of August 4, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable once an attacker gains authenticated access to the web interface.

Analyst Recommendation

The high CVSS score reflects the severity of potential remote code execution on networking equipment. Administrators must prioritize applying the vendor-supplied patch to prevent unauthorized system control.

Description Summary:
The OpenWrt luci-app-bmx7 package is vulnerable to path traversal via the bmx7-info CGI script, allowing unauthenticated attackers to read arbitrary files.

Executive Summary:
A path traversal vulnerability in OpenWrt luci-app-bmx7 allows unauthenticated remote attackers to read sensitive files from the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-69095

Affected Software: OpenWrt luci-app-bmx7

Affected Versions: 0 up to (excluding) commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd

Vulnerability: The vulnerability exists within the bmx7-info CGI script, which fails to properly sanitize user input, leading to a path traversal (CWE-22) condition. This flaw allows an unauthenticated attacker to escape the designated runtime directory and access arbitrary files on the system.

Business Impact

Successful exploitation allows for the disclosure of sensitive configuration files, system credentials, or other restricted data residing on the device. This breach of confidentiality can facilitate further lateral movement or complete takeover of the affected networking equipment, justifying the high CVSS score of 7.5.

Remediation Plan

Immediate Action: Update the luci-app-bmx7 package to the version containing commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd or later.

Proactive Monitoring: Audit system logs for directory traversal patterns, such as sequences of double dots and slashes (../), in URL requests targeting CGI scripts.

Compensating Controls: Restrict access to the management interface of the OpenWrt device to trusted network segments or use a WAF to block requests containing path traversal payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 4, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The simplicity of the attack vector makes it a likely target for automated scanning.

Analyst Recommendation

This vulnerability presents a clear risk to sensitive system data. Administrators should verify their current commit version and apply the update immediately to prevent unauthorized file disclosure and potential system compromise.

Description Summary:
LuCI app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter, allowing authenticated users to inject active HTML.

Executive Summary:
An authenticated stored cross-site scripting vulnerability in the OpenWrt LuCI HTTPS DNS Proxy application could allow an attacker to execute malicious scripts in an administrator's browser.

Vulnerability Details

CVE-ID: CVE-2026-67352

Affected Software: OpenWrt LuCI

Affected Versions: openwrt luci: 0 and later

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability within the resolver_url parameter. It requires an authenticated user to perform the injection, which then executes when an administrator views the status page.

Business Impact

Successful exploitation of this flaw could lead to session hijacking and unauthorized administrative actions within the OpenWrt interface. Given the CVSS score of 7.6, this represents a significant risk to the integrity and security of network management infrastructure.

Remediation Plan

Immediate Action: Review the official OpenWrt security advisory at https://github.com/openwrt/luci/security/advisories/GHSA-c6vf-395q-4jv6 for specific patch instructions.

Proactive Monitoring: Monitor system access logs for suspicious administrative activity or unusual characters within configuration parameters.

Compensating Controls: Restrict administrative access to the LuCI interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for authenticated access limits its utility for external attackers.

Analyst Recommendation

Administrators should prioritize verifying the status of their LuCI installations against the vendor advisory. Apply all recommended security updates as they become available to prevent potential session compromise.

Description Summary:
A vulnerability in the OpenWrt DHCPv6 client allows for Cross-site Scripting (XSS) via injected lease hostnames displayed in the web administrative interface.

Executive Summary:
OpenWrt is vulnerable to a Stored Cross-site Scripting (XSS) attack that allows an attacker to execute malicious scripts in the context of an administrator's browser session.

Vulnerability Details

CVE-ID: CVE-2026-62948

Affected Software: openwrt openwrt

Affected Versions: All versions prior to 25.12.5

Vulnerability: The vulnerability stems from improper neutralization of DHCPv6 client FQDN options, which are written to system files and subsequently rendered as live HTML in the LuCI administrative interface, allowing unauthenticated attackers to inject malicious scripts.

Business Impact

An attacker can leverage this vulnerability to gain unauthorized access to administrative sessions. With a CVSS score of 9.6, the potential for account takeover and subsequent configuration changes to network devices poses a significant risk to organizational network integrity and security.

Remediation Plan

Immediate Action: Upgrade to OpenWrt version 25.12.5 or later to ensure proper sanitization of DHCP lease inputs.

Proactive Monitoring: Review the Active DHCPv6 Leases page for suspicious entries that contain script tags or unexpected special characters.

Compensating Controls: Restrict access to the LuCI administrative interface to trusted management networks only to minimize exposure.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable via network-adjacent or remote DHCP interactions.

Analyst Recommendation

This critical XSS vulnerability provides a path for administrative compromise. Due to the existence of a proof-of-concept and the high severity of the flaw, organizations should expedite the update to version 25.12.5 across all managed OpenWrt devices.

Description Summary:
The luci-app-banip component in OpenWrt is vulnerable to log injection, where an attacker can influence log parsing to inject arbitrary IP addresses.

Executive Summary:
A log parsing vulnerability in the OpenWrt luci-app-banip plugin allows unauthenticated attackers to manipulate IP blacklists, potentially causing a denial-of-service or security bypass.

Vulnerability Details

CVE-ID: CVE-2026-62184

Affected Software: OpenWrt LuCI (specifically luci-app-banip)

Affected Versions: 0 through 0.11.1

Vulnerability: The application utilizes an awk-based parser that fails to properly sanitize or validate log fields (CWE-116). An unauthenticated attacker can inject arbitrary IP addresses via controlled fields like usernames, which the parser then incorrectly extracts and processes.

Business Impact

By injecting arbitrary IP addresses into the ban list, an attacker can cause legitimate traffic to be blocked, resulting in a denial-of-service (DoS) condition. With a CVSS score of 7.5, this vulnerability is significant for network infrastructure integrity, potentially allowing attackers to disrupt network security enforcement mechanisms.

Remediation Plan

Immediate Action: Update the luci-app-banip package to the version containing the fix for commit d9bbc372e29618a8807b693a1ccf6d0e42cd196c.

Proactive Monitoring: Monitor firewall logs and banip activity for unexpected or suspicious IP addresses appearing in the blocklist that do not correlate with actual malicious behavior.

Compensating Controls: If immediate patching is not feasible, consider disabling the automated log-parsing features of the banip application to prevent unauthorized manipulation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently susceptible to manipulation due to the lack of input sanitization in the parsing logic.

Analyst Recommendation

The integrity of network security controls is paramount. Organizations utilizing the OpenWrt luci-app-banip plugin should apply the provided fix immediately to ensure that log parsing remains secure and resistant to malicious injection.

Description Summary:
A stored XSS vulnerability in OpenWrt LuCI allows adjacent network attackers to inject malicious HTML via DHCPv6 lease hostnames.

Executive Summary:
A stored cross-site scripting vulnerability in OpenWrt LuCI allows adjacent network attackers to execute malicious scripts in the browser of an administrator.

Vulnerability Details

CVE-ID: CVE-2026-61876

Affected Software: OpenWrt LuCI

Affected Versions: LuCI to 3.0.0 (exclusive)

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability caused by the failure to properly encode DHCPv6 lease hostnames. An attacker on the local network can inject malicious HTML/JavaScript tags into the hostname, which will be executed in the administrator's browser when the status table is viewed.

Business Impact

This vulnerability carries a CVSS score of 8.8, representing a High severity risk. By exploiting this, an adjacent attacker can perform malicious actions in the context of the administrator’s session, such as stealing session cookies, redirecting the user to malicious sites, or performing unauthorized administrative actions, which could ultimately lead to full network compromise.

Remediation Plan

Immediate Action: Update the LuCI web interface to version 3.0.0 or later as indicated in the vendor advisory at https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh.

Proactive Monitoring: Review DHCPv6 lease tables and web access logs for any evidence of malformed hostnames or unusual administrative activity.

Compensating Controls: Restrict access to the administrative web interface by limiting the networks or specific IP addresses allowed to reach the management console.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable by any device capable of communicating on the local network segment.

Analyst Recommendation

Administrators should update the LuCI interface immediately to version 3.0.0 or newer to remediate this flaw. Given the ease with which adjacent attackers can inject malicious payloads, ensuring that the management interface is not exposed to untrusted clients is a critical defensive measure.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the OpenWrt luci-app-upnp package allows unauthenticated LAN attackers to execute malicious JavaScript via UPnP IGD AddPortMapping requests.

Executive Summary:
A critical stored XSS vulnerability in OpenWrt's luci-app-upnp component allows unauthenticated attackers to execute arbitrary code in the context of an administrator session.

Vulnerability Details

CVE-ID: CVE-2026-61875

Affected Software: OpenWrt LuCI

Affected Versions: All versions of luci-app-upnp are affected.

Vulnerability: This is a stored cross-site scripting (XSS) flaw occurring when the application fails to sanitize input within the NewPortMappingDescription field. An unauthenticated attacker on the local network can inject malicious payloads that execute when an administrator views the affected UPnP or Status pages.

Business Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of an authenticated administrator. This can lead to unauthorized configuration changes, session hijacking, or further compromise of the network gateway. With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and security of the administrative interface.

Remediation Plan

Immediate Action: Update your OpenWrt firmware to the latest available version, which includes a patched luci-app-upnp package.

Proactive Monitoring: Review web interface access logs for unusual activity or requests containing unexpected script tags in UPnP-related parameters.

Compensating Controls: If immediate patching is not feasible, restrict network access to the LuCI administrative interface and disable the UPnP service if it is not required for network operations.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists.

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it requires no authentication to trigger the payload storage.

Analyst Recommendation

Given the ease of exploitation and the potential for full administrative compromise, organizations should prioritize updating their OpenWrt instances. Administrators must ensure that the luci-app-upnp package is patched to the latest version to prevent potential session hijacking and unauthorized gateway manipulation.

Description Summary:
A privilege management vulnerability in OpenWrt's luci-app-samba4 allows authenticated delegated users to execute the Samba daemon with arbitrary arguments, resulting in command execution.

Executive Summary:
An improper privilege management flaw in the OpenWrt LuCI Samba application allows authenticated users to achieve remote code execution on the underlying system.

Vulnerability Details

CVE-ID: CVE-2026-59260

Affected Software: OpenWrt LuCI

Affected Versions: OpenWrt luci-app-samba4 component; all shipped versions are affected until patched.

Vulnerability: This is an improper privilege management vulnerability (CWE-269). Authenticated users with delegated permissions can manipulate the Samba daemon execution parameters, which leads to arbitrary command execution with elevated privileges.

Business Impact

With a CVSS score of 8.8, this vulnerability represents a severe threat to the integrity and confidentiality of the affected device. Successful exploitation allows an authenticated attacker to execute code as the user running the Samba daemon, potentially gaining full control over the router or appliance and facilitating lateral movement within the network.

Remediation Plan

Immediate Action: Update the luci-app-samba4 component to the latest available version provided by OpenWrt.

Proactive Monitoring: Review system logs for unusual process execution patterns or modifications to Samba configuration files that may indicate exploitation attempts.

Compensating Controls: Disable the Samba application if it is not strictly required for business operations, and enforce strict network access controls to ensure that only authorized users can access the LuCI management interface.

Exploitation Status

Public Exploit Available: Yes — a proof-of-concept exists per CISA's SSVC assessment.

Analyst Notes: As of July 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker has access to the management interface.

Analyst Recommendation

Due to the existence of a proof-of-concept and the high-severity nature of remote code execution, this update should be applied as soon as a stable patch is available. Organizations should verify that their management interfaces are not exposed to the public internet to minimize the attack surface.

Description Summary:
A security vulnerability has been identified in the luci-proto-openvpn package, potentially impacting network security configurations.

Executive Summary:
The openvpn luci-proto-openvpn package contains a high-severity vulnerability that could allow for unauthorized network configuration changes or potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-58000

Affected Software: openvpn luci-proto-openvpn

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability affects the luci-proto-openvpn package. The flaw could allow an attacker to manipulate or bypass security settings within the interface, potentially leading to unauthorized access to the underlying network infrastructure.

Business Impact

With a CVSS score of 8.8, this vulnerability is classified as High severity. Exploitation could allow an attacker to gain unauthorized control over VPN configurations, leading to potential interception of traffic, unauthorized network access, or complete service disruption, significantly impacting business continuity.

Remediation Plan

Immediate Action: Update the luci-proto-openvpn package to the latest version via the vendor’s repository or update mechanism.

Proactive Monitoring: Monitor VPN logs for unauthorized configuration changes or anomalous connection attempts that deviate from established baselines.

Compensating Controls: Ensure that management access to the OpenVPN interface is restricted to secure, internal management networks only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the critical nature of VPN infrastructure, this vulnerability should be treated with high urgency. Administrators must verify their current version and apply the necessary security updates to prevent potential unauthorized access to their network perimeter.

Description Summary:
The OpenWrt Luci-app-tailscale-community package is susceptible to command injection, potentially allowing unauthorized system command execution.

Executive Summary:
A critical command injection vulnerability in the OpenWrt Luci-app-tailscale-community package poses a severe risk of unauthorized remote code execution on affected network devices.

Vulnerability Details

CVE-ID: CVE-2026-57999

Affected Software: OpenWrt Luci-app-tailscale-community

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves a command injection flaw within the tailscale configuration component, which may allow an authenticated attacker to execute arbitrary system commands with elevated privileges.

Business Impact

The exploitation of this vulnerability could lead to a complete compromise of the underlying router or network appliance. Given the CVSS score of 8.8, this represents a high-severity risk that could result in unauthorized network access, data exfiltration, or the establishment of a persistent foothold within the network infrastructure.

Remediation Plan

Immediate Action: Audit OpenWrt package repositories and apply all available security updates for the Luci-app-tailscale-community package immediately.

Proactive Monitoring: Monitor system logs for unusual shell command execution patterns or unexpected network traffic originating from the Tailscale service.

Compensating Controls: Restrict administrative access to the Luci web interface to trusted management IP addresses to prevent unauthorized access by potential attackers.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score, organizations using this package should prioritize patching. If a patch is unavailable, disable the affected service until a secure version is released to mitigate the risk of remote command execution.

Description Summary:
OpenWrt LuCI contains a stored cross-site scripting (XSS) vulnerability in the wireless scan modal, allowing attackers to execute arbitrary code via malicious SSID values.

Executive Summary:
A stored cross-site scripting vulnerability in the OpenWrt LuCI interface allows for potential arbitrary code execution when a user interacts with the wireless scan feature.

Vulnerability Details

CVE-ID: CVE-2026-32721

Affected Software: OpenWrt LuCI

Affected Versions: openwrt luci: < 26.072.65753~068150b; openwrt openwrt: < 24.10.6, >= 25.12.0, < 25.12.1

Vulnerability: This is a stored XSS vulnerability (CWE-79) triggered when the wireless scan modal renders unsanitized SSID values as raw HTML. Successful exploitation requires a user with access to the web interface to trigger a wireless scan, at which point the malicious payload is executed within the context of the user's browser session.

Business Impact

Successful exploitation poses a significant risk to administrative sessions, as an attacker can execute arbitrary JavaScript to hijack user sessions, perform unauthorized configuration changes, or gain further control over the network device. With a CVSS score of 8.6, this vulnerability is classified as High severity, reflecting the potential for total compromise of the affected device and its management interface.

Remediation Plan

Immediate Action: Upgrade the OpenWrt LuCI package to version 26.072.65753~068150b or update the base OpenWrt firmware to version 24.10.6 or 25.12.1 as applicable.

Proactive Monitoring: Monitor web interface access logs for unusual activity or unexpected requests originating from the wireless scan module.

Compensating Controls: Restrict access to the LuCI web interface to trusted administrative IP addresses only, and avoid performing wireless scans in environments where untrusted wireless networks are present.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 21, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the reliance on user interaction to trigger the malicious payload does not significantly reduce the risk in environments where administrators frequently perform wireless site surveys.

Analyst Recommendation

Given the potential for complete administrative session compromise, organizations should prioritize patching their OpenWrt instances immediately. Administrators should verify their current firmware version and apply the identified security updates to ensure the wireless scan functionality is properly sanitized against malicious SSID payloads.

Description Summary:
A heap-based buffer overflow in the ubusd component of OpenWrt allows local authenticated attackers to achieve arbitrary code execution and bypass access control lists.

Executive Summary:
A heap buffer overflow vulnerability in the OpenWrt ubusd daemon allows authenticated local attackers to achieve arbitrary code execution and bypass security controls, warranting immediate attention.

Vulnerability Details

CVE-ID: CVE-2025-62526

Affected Software: OpenWrt ubusd

Affected Versions: < 24.10.4

Vulnerability: This vulnerability involves a heap-based buffer overflow (CWE-122) within the event registration parsing code of the ubus daemon. The flaw is reachable by any authenticated ubus client and occurs before access control list (ACL) checks are processed, allowing for both memory corruption and authorization bypass.

Business Impact

The ability to execute arbitrary code within the context of the ubus daemon provides an attacker with significant control over the embedded device. Given the CVSS score of 7.9, this vulnerability represents a high risk that could lead to full system compromise, persistent unauthorized access, or the disruption of critical network services managed by the OpenWrt platform.

Remediation Plan

Immediate Action: Upgrade OpenWrt to version 24.10.4 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual crashes or unexpected behavior related to the ubus daemon, which may indicate exploitation attempts.

Compensating Controls: Ensure that access to the local bus is restricted to only necessary and trusted processes to reduce the attack surface for local users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, the requirement for local authenticated access limits the immediate scope to users or processes already present on the system.

Analyst Recommendation

The severity of this flaw, combined with the potential for arbitrary code execution on embedded infrastructure, necessitates a prompt response. Administrators should prioritize the deployment of the 24.10.4 update across all managed OpenWrt devices to mitigate the risk of local privilege escalation and unauthorized system control.

Description Summary:
A kernel memory access vulnerability in the OpenWrt ltq-ptm driver allows local users to read and write arbitrary kernel memory, potentially enabling sandbox escapes.

Executive Summary:
A high-severity kernel memory access vulnerability in OpenWrt versions prior to 24.10.4 poses a significant risk of sandbox escape and unauthorized system control.

Vulnerability Details

CVE-ID: CVE-2025-62525

Affected Software: OpenWrt

Affected Versions: < 24.10.4

Vulnerability: This vulnerability involves improper input validation, out-of-bounds read, and out-of-bounds write flaws within the ltq-ptm driver. A local attacker with low privileges can leverage these ioctl flaws to manipulate kernel memory, potentially bypassing security boundaries like ujail sandboxes.

Business Impact

The ability to read and write arbitrary kernel memory represents a critical security failure, as it allows an attacker to escalate privileges or compromise the underlying host system. While the vulnerability requires local access, successful exploitation could lead to full system takeover and persistent unauthorized access, severely damaging the integrity of the network appliance. Given the CVSS score of 7.9, this issue should be prioritized for remediation in environments where untrusted local users or sandboxed processes exist.

Remediation Plan

Immediate Action: Upgrade to OpenWrt version 24.10.4 or later to apply the necessary security patches to the ltq-ptm driver.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access sensitive device drivers or unusual kernel-level activity originating from sandboxed services.

Compensating Controls: Since no workarounds exist, ensure that access to the device is strictly limited to authorized personnel and that any untrusted services are restricted using the most stringent available security profiles.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically complex, requiring specific hardware configurations using the lantiq target in PTM mode, which limits its immediate real-world attack surface.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of OpenWrt-based devices, particularly those utilized in sensitive network routing roles. Administrators must prioritize the upgrade to version 24.10.4 to ensure the kernel memory access flaws are fully addressed. Failure to patch leaves devices susceptible to privilege escalation and sandbox breakout attempts by local attackers.