LuCI DHCPv6 Lease Hostname Stored XSS (CVE‑2026‑61876) Enables Remote Code Execution on OpenWrt Routers
What Happened — A stored cross‑site scripting (XSS) vulnerability (CVE‑2026‑61876) was disclosed in OpenWrt’s LuCI web interface. An unauthenticated attacker on the same LAN can inject malicious JavaScript via the DHCPv6 client FQDN option, which is later rendered unsanitized in the status tables, potentially allowing execution of arbitrary code in the administrator’s browser session.
Why It Matters for Compliance & Audit Readiness —
- The flaw highlights a missing input‑validation control, a gap that SOC 2’s CC6.1 (System Operations) and CC7.1 (Change Management) require organizations to monitor continuously.
- It underscores the importance of maintaining auditable evidence that third‑party open‑source components are patched—a core use case for Verisq’s Control‑Mapping capability.
- Demonstrates why continuous‑compliance programs must capture remediation tickets and patch‑level evidence to provide a defensible audit trail.
Who Is Affected — Vendors and enterprises that deploy OpenWrt‑based routers, ISPs, managed‑service providers, and any organization exposing the LuCI UI to internal users.
Recommended Actions —
- Upgrade LuCI to a version that includes commit 55379d0 (or later) which fixes the XSS issue.
- Map the input‑validation control to SOC 2 CC6.1, capture the patch‑deployment ticket as evidence, and feed it into your continuous‑compliance dashboard.
- Deploy automated static‑code scanning for XSS patterns in web UI components and integrate findings with your control‑evidence pipeline. Source: https://www.exploit-db.com/exploits/52637
Technical Notes — The attack vector is DHCPv6 option 39 (Client FQDN); the malicious hostname is stored by odhcpd and rendered via innerHTML without sanitization. CVSS 8.8 (High). Source: https://www.exploit-db.com/exploits/52637