High severity · published Jul 12, 2026
CVE-2026-61876
LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
8.8
CVSS
1.6%
EPSS
No
On KEV
Description
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LU
luci · openwrt
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-61876
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-61876
github.com
https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
www.vulncheck.com
https://www.vulncheck.com/advisories/luci-dhcpv6-lease-hostname-stored-cross-site-scripting
More from luci
9.9
CVE-2026-72842
OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
9.9
CVE-2026-72841
luci-app-openvpn Path Traversal RCE via instance_name2
9.8
CVE-2019-12272
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command…
8.8
CVE-2026-55897
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
8.8
CVE-2026-72840
OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write