A stored cross-site scripting vulnerability in the OpenWrt LuCI interface allows for potential arbitrary code execution when a user interacts with the wireless scan feature.

This is a stored XSS vulnerability (CWE-79) triggered when the wireless scan modal renders unsanitized SSID values as raw HTML. Successful exploitation requires a user with access to the web interface to trigger a wireless scan, at which point the malicious payload is executed within the context of the user's browser session.

Successful exploitation poses a significant risk to administrative sessions, as an attacker can execute arbitrary JavaScript to hijack user sessions, perform unauthorized configuration changes, or gain further control over the network device. With a CVSS score of 8.6, this vulnerability is classified as High severity, reflecting the potential for total compromise of the affected device and its management interface.

Immediate Action: Upgrade the OpenWrt LuCI package to version 26.072.65753~068150b or update the base OpenWrt firmware to version 24.10.6 or 25.12.1 as applicable.

Proactive Monitoring: Monitor web interface access logs for unusual activity or unexpected requests originating from the wireless scan module.

Compensating Controls: Restrict access to the LuCI web interface to trusted administrative IP addresses only, and avoid performing wireless scans in environments where untrusted wireless networks are present.

Public Exploit Available: Unknown

Given the potential for complete administrative session compromise, organizations should prioritize patching their OpenWrt instances immediately. Administrators should verify their current firmware version and apply the identified security updates to ensure the wireless scan functionality is properly sanitized against malicious SSID payloads.