CVE-2026-61875: luci-app-upnp Stored XSS Vulnerability

CVE-2026-61875 Overview

CVE-2026-61875 is a stored cross-site scripting (XSS) vulnerability in luci-app-upnp, the LuCI web interface component for managing Universal Plug and Play (UPnP) on OpenWrt routers. Unauthenticated LAN clients can inject JavaScript through UPnP Internet Gateway Device (IGD) AddPortMapping Simple Object Access Protocol (SOAP) requests. The miniupnpd daemon stores the malicious NewPortMappingDescription value, and luci-app-upnp renders it without output encoding. When an administrator loads the UPnP or Status pages, the injected payload executes in the browser session [CWE-79].

Critical Impact
An attacker with only LAN access and no credentials can execute arbitrary JavaScript in the router administrator's browser, enabling session hijacking, configuration tampering, and full device takeover.

Affected Products

OpenWrt luci-app-upnp package
Routers running LuCI with the UPnP application installed
Deployments using miniupnpd as the UPnP IGD backend

Discovery Timeline

2026-07-12 - CVE-2026-61875 published to NVD
2026-07-13 - CVE-2026-61875 last updated in NVD database

Technical Details for CVE-2026-61875

Vulnerability Analysis

The flaw resides in how luci-app-upnp presents port mapping data supplied through the UPnP IGD control protocol. UPnP IGD exposes a SOAP endpoint that accepts AddPortMapping requests without authentication, as required by the specification for LAN clients. The NewPortMappingDescription field is intended to hold a human-readable label. miniupnpd writes the value to its lease store verbatim, and luci-app-upnp reads it back and embeds it directly into HTML rendered on the UPnP status view and the main Status page.

Because the LuCI templates omit HTML entity encoding on this field, any markup or <script> tag in the description executes in the administrator's authenticated session. The attacker needs only network reachability to the router's UPnP port on the LAN. Impact includes theft of LuCI session cookies, forced configuration changes through the administrator's browser, and pivoting into router firmware management.

Root Cause

The root cause is missing output encoding in the LuCI view templates that render UPnP port mapping entries. The application trusts data returned by miniupnpd, but that data originates from unauthenticated SOAP clients. There is no server-side sanitization on write and no HTML escaping on read, breaking the fundamental XSS defense chain [CWE-79].

Attack Vector

An attacker on the LAN sends a crafted UPnP AddPortMapping SOAP request to the router. The NewPortMappingDescription element contains an HTML or JavaScript payload rather than a benign label. miniupnpd accepts and persists the mapping. When the administrator subsequently opens the LuCI UPnP or Status page, the browser parses and executes the injected script under the LuCI origin. User interaction is required only in the sense that the administrator must load an affected page. See the GitHub Security Advisory and the VulnCheck Security Advisory for technical details.

Detection Methods for CVE-2026-61875

Indicators of Compromise

UPnP lease entries with NewPortMappingDescription values containing <, >, script, onerror, onload, or javascript: substrings.
Unexpected outbound requests from an administrator's browser immediately after visiting the LuCI UPnP or Status page.
Unusual LuCI configuration changes originating from the administrator's session without corresponding admin activity.

Detection Strategies

Inspect the miniupnpd lease file (typically /var/run/miniupnpd.leases or /tmp/upnp.leases) for description fields containing HTML control characters.
Review LuCI access logs for administrator sessions loading admin/services/upnp or the Status page followed by anomalous POST requests.
Monitor SOAP AddPortMapping traffic on the LAN for descriptions that deviate from typical client strings such as browser or game console labels.

Monitoring Recommendations

Alert on new UPnP port mappings whose description fields contain non-printable characters or HTML markup.
Track LuCI administrator session activity for changes to firewall, DHCP, or credential settings that closely follow UPnP page views.
Retain router syslog output centrally so miniupnpd mapping events remain available for correlation and incident review.

How to Mitigate CVE-2026-61875

Immediate Actions Required

Upgrade luci-app-upnp to the patched version referenced in the OpenWrt LuCI advisory GHSA-8v49-6387-7f89.
Disable the UPnP service on any router where UPnP IGD is not strictly required by LAN applications.
Purge existing miniupnpd lease entries to remove any pre-planted payloads before administrators visit the LuCI UPnP page.

Patch Information

OpenWrt maintainers have published a fix in the LuCI project that adds proper HTML output encoding to UPnP description rendering. Refer to the GitHub Security Advisory GHSA-8v49-6387-7f89 for the specific commit and affected package versions, and update through opkg or the OpenWrt system upgrade path.

Workarounds

Stop and disable miniupnpd where UPnP is not needed using /etc/init.d/miniupnpd stop and /etc/init.d/miniupnpd disable.
Restrict LAN access to the UPnP SOAP port via firewall rules so only trusted hosts can create mappings.
Avoid opening the LuCI UPnP or Status pages on unpatched devices until the update is applied, since simply viewing the page triggers execution.

bash

# Configuration example
# Disable and stop miniupnpd on OpenWrt until patch is applied
/etc/init.d/miniupnpd stop
/etc/init.d/miniupnpd disable
uci set upnpd.config.enabled='0'
uci commit upnpd

# Remove any existing (potentially malicious) UPnP leases
rm -f /var/run/miniupnpd.leases /tmp/upnp.leases

# After updating luci-app-upnp, verify the installed version
opkg update
opkg list-installed | grep luci-app-upnp