CVE-2026-62948
OpenWrt routers running versions earlier than 25.12.5 are vulnerable to a cross‑site scripting flaw. The DHCPv6 client writes unescaped hostnames into a lease file, allowing an attacker to inject malicious HTML into the router’s web interface. The flaw can be exploited by anyone who can send a crafted DHCPv6 request to the device.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All OpenWrt installations on embedded routers that are using a firmware version older than 25.12.5. Typical users include home and small‑business router owners.
Real-world impact
An attacker could inject arbitrary HTML or JavaScript into the router’s admin page, potentially tricking users into clicking links, downloading malware, or revealing sensitive information. The attack does not require any special privileges on the router.
Why this severity
The CVSS score of 9.6 reflects that the vulnerability is exploitable over the network (AV:N), requires low effort (AC:L), no user privileges (PR:N), and needs user interaction (UI:R). It also changes the scope of the affected component (S:C) and has high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
- 01Upgrade OpenWrt to version 25.12.5 or later.
- 02Restart the router to ensure the new firmware is active.
NVD-referenced vendor advisory
Timeline
- Jul 15, 2026 · 18d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 12d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/openwrt/luci/commit/55379d0…patch
- github.com/openwrt/odhcpd/commit/68f38…patch
- github.com/openwrt/odhcpd/pull/404issue trackingpatch
- github.com/openwrt/openwrt/releases/ta…release notes
- github.com/openwrt/openwrt/security/ad…exploitmitigationvendor advisory