CVE-2026-61876: LuCI DHCPv6 XSS Vulnerability

CVE-2026-61876 Overview

CVE-2026-61876 is a stored Cross-Site Scripting (XSS) vulnerability in LuCI, the default web interface for OpenWrt-based routers. LuCI fails to encode DHCPv6 lease hostnames before rendering them in status tables. An adjacent network attacker can send a DHCPv6 Client FQDN option containing HTML or script markup. The payload executes in the administrator's browser when the DHCP lease page is viewed. Because LuCI runs with root-level administrative privileges, script execution in the admin session enables full router compromise. The vulnerability is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Adjacent network attackers can execute arbitrary JavaScript in the router administrator's browser session, leading to full device takeover through the LuCI interface.

Affected Products

OpenWrt LuCI web interface
OpenWrt devices exposing DHCPv6 lease status pages
Downstream distributions embedding LuCI

Discovery Timeline

2026-07-12 - CVE-2026-61876 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-61876

Vulnerability Analysis

The flaw resides in LuCI's DHCPv6 lease rendering logic. When the LuCI status view queries active DHCPv6 leases from odhcpd, it reads the client-supplied hostname field and inserts it directly into the HTML response without output encoding. The DHCPv6 Client FQDN option (Option 39) allows clients to advertise their hostname. LuCI trusts this attacker-controllable field as safe text.

When an administrator opens the DHCP lease page, the browser parses the injected markup as HTML. Script content executes in the LuCI origin with the administrator's authenticated session. From there, an attacker can invoke privileged LuCI RPC endpoints, modify firewall rules, install packages via opkg, or replace the root password.

Root Cause

The root cause is missing output encoding on untrusted DHCPv6 client-supplied data. LuCI's template rendering path for the DHCPv6 lease table emits the hostname value without applying HTML entity escaping. This violates standard defensive templating practices where all client-controlled string data must be encoded before insertion into an HTML context.

Attack Vector

Exploitation requires adjacent network access — the attacker must be on the same Layer 2 network as the OpenWrt router, or otherwise able to reach it with a DHCPv6 solicitation. The attacker crafts a DHCPv6 SOLICIT or REQUEST message that includes an Option 39 (Client FQDN) payload containing HTML tags such as <script> or event-handler attributes. The malicious lease is stored persistently in the DHCPv6 lease database. The XSS triggers when any administrator subsequently views the DHCP status page in LuCI. Because the payload persists across sessions, it constitutes a stored XSS with high reliability.

For technical details, see the GitHub Security Advisory GHSA-686p-p8p9-x6fh and the VulnCheck Advisory.

Detection Methods for CVE-2026-61876

Indicators of Compromise

DHCPv6 lease entries with hostname fields containing <, >, ", ', or script substrings
Unexpected outbound HTTP requests from the router immediately after an administrator opens LuCI DHCP status pages
Unauthorized changes to /etc/config/* files, particularly firewall, dropbear, or uhttpd, following LuCI admin sessions
New or modified accounts in /etc/passwd or /etc/shadow on the router

Detection Strategies

Inspect odhcpd lease files such as /tmp/hosts/odhcpd and /var/run/odhcpd.leases for hostnames containing HTML metacharacters
Monitor DHCPv6 traffic on management VLANs for Option 39 payloads that include angle brackets or scripting keywords
Alert on LuCI RPC calls to sensitive endpoints (uci, sys.exec, package management) that originate from admin sessions correlated with DHCP page views

Monitoring Recommendations

Forward router syslog and odhcpd events to a central log platform and search for suspicious hostname patterns
Baseline expected DHCPv6 client hostnames per subnet and alert on non-conforming values
Track LuCI configuration file changes with file integrity monitoring on the router when supported

How to Mitigate CVE-2026-61876

Immediate Actions Required

Upgrade LuCI to the fixed version referenced in GHSA-686p-p8p9-x6fh as soon as it is available for your OpenWrt release
Restrict LuCI administrative access to trusted management networks and disable WAN-side access to the web interface
Review current DHCPv6 leases and remove any entries with suspicious hostname content
Rotate router administrator credentials if the DHCP status page has been accessed since exposure

Patch Information

Refer to the OpenWrt LuCI security advisory GHSA-686p-p8p9-x6fh for the patched LuCI package version and upgrade instructions. The fix applies HTML entity encoding to DHCPv6 lease hostnames before they are inserted into the status view. Update via opkg update && opkg upgrade luci once the fixed package is published for your target release.

Workarounds

Segment untrusted clients onto a separate VLAN or SSID that does not share the DHCPv6 server with the management network
Avoid opening the LuCI DHCP lease status page until the patched LuCI version is installed
Temporarily disable the DHCPv6 server (odhcpd) on interfaces exposed to untrusted users if IPv6 address assignment is not required

bash

# Temporarily disable DHCPv6 server on untrusted interfaces
uci set dhcp.lan.dhcpv6='disabled'
uci set dhcp.lan.ra='disabled'
uci commit dhcp
/etc/init.d/odhcpd restart

# After patched LuCI package is available
opkg update
opkg upgrade luci luci-base luci-mod-status