CVE-2026-62948

Katalog CVE

CVSS 9.6 · Critical EPSS 0,58%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada openwrt. Skor CVSS 3.1 9.6 (Critical) menurut github.com.

Deskripsi (NVD)

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

Rincian

Terbit di NVD

15 Juli 2026

Terakhir diubah

21 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.6 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-117: Improper Output Neutralization for Logs
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

0,58% peluang dieksploitasi; lebih tinggi dari 46,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f exploit · mitigasi · advisory vendor
• https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048a patch
• https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3a patch
• https://github.com/openwrt/odhcpd/pull/404 issue tracking · patch
• https://github.com/openwrt/openwrt/releases/tag/v25.12.5 release notes