Medium severity · published May 25, 2021
CVE-2021-33425
A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary Javascript in the…
5.4
CVSS
0.5%
EPSS
No
On KEV
Description
A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary Javascript in the OpenWRT Hostname via the Hostname Change operation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openwrt · Openwrt
19.07.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-33425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-33425
Mailing List
http://www.openwall.com/lists/oss-security/2021/11/09/1
More from Openwrt
9.8
CVE-2026-30872
OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup
9.8
CVE-2026-30871
OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query
9.8
CVE-2025-20683
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check
9.8
CVE-2025-20682
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check
9.8
CVE-2025-20681
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check