Openwrt Luci
20 CVEs affecting Openwrt Luci. Latest disclosed: 2026-08-22. Critical: 3, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72842 | Critical | 9.9 | 2026-08-13 | luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes with… |
CVE-2026-72841 | Critical | 9.9 | 2026-08-13 | luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write a… |
CVE-2019-12272 | Critical | 9.8 | 2019-05-23 | In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affecte… |
CVE-2026-72840 | High | 8.8 | 2026-08-13 | OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for m… |
CVE-2026-69096 | High | 8.8 | 2026-08-03 | OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an O… |
CVE-2026-61876 | High | 8.8 | 2026-07-12 | LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Atta… |
CVE-2026-61875 | High | 8.8 | 2026-07-12 | luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOA… |
CVE-2026-59260 | High | 8.8 | 2026-07-12 | OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-… |
CVE-2026-58000 | High | 8.8 | 2026-06-29 | luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta paramet… |
CVE-2026-57999 | High | 8.8 | 2026-06-29 | luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitra… |
CVE-2026-32721 | High | 8.6 | 2026-03-19 | LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where S… |
CVE-2026-67352 | High | 7.6 | 2026-08-01 | luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HT… |
CVE-2026-69095 | High | 7.5 | 2026-08-03 | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows un… |
CVE-2026-62184 | High | 7.5 | 2026-07-13 | luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, all… |
CVE-2026-62381 | Medium | 6.6 | 2026-08-22 | luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.c) when signing a certificate with a 20… |
CVE-2021-27821 | Medium | 6.1 | 2021-05-25 | The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability. |
CVE-2026-68583 | Medium | 5.4 | 2026-08-02 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inj… |
CVE-2023-24181 | Medium | 5.4 | 2023-04-10 | LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pa… |
CVE-2022-41435 | Medium | 5.4 | 2022-11-03 | OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js… |
CVE-2020-10871 | Medium | 5.3 | 2020-03-23 | In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance… |