A critical stored XSS vulnerability in OpenWrt's luci-app-upnp component allows unauthenticated attackers to execute arbitrary code in the context of an administrator session.

This is a stored cross-site scripting (XSS) flaw occurring when the application fails to sanitize input within the NewPortMappingDescription field. An unauthenticated attacker on the local network can inject malicious payloads that execute when an administrator views the affected UPnP or Status pages.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of an authenticated administrator. This can lead to unauthorized configuration changes, session hijacking, or further compromise of the network gateway. With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and security of the administrative interface.

Immediate Action: Update your OpenWrt firmware to the latest available version, which includes a patched luci-app-upnp package.

Proactive Monitoring: Review web interface access logs for unusual activity or requests containing unexpected script tags in UPnP-related parameters.

Compensating Controls: If immediate patching is not feasible, restrict network access to the LuCI administrative interface and disable the UPnP service if it is not required for network operations.

Public Exploit Available: Yes, a public proof-of-concept exists.

Given the ease of exploitation and the potential for full administrative compromise, organizations should prioritize updating their OpenWrt instances. Administrators must ensure that the luci-app-upnp package is patched to the latest version to prevent potential session hijacking and unauthorized gateway manipulation.