Skip to content
OpenAdvisories

Vendor

openwrt

38 known vulnerabilities.

Products

luci 13 openwrt 13 odhcpd 5 uhttpd 3 luci-app-tailscale-community 1 luci-app-banip 1 asu 1 luci-app-adblock-fast 1 luci-app-travelmate 1 travelmate 1 luci-proto-openvpn 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-53921 Public exploit

    odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

    odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to n…

    openwrt odhcpd
  • Critical 9.9
    CVE-2026-72842

    OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass

    luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` …

    openwrt luci
  • Critical 9.9
    CVE-2026-72841

    luci-app-openvpn Path Traversal RCE via instance_name2

    luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persi…

    openwrt luci
  • Critical 9.6
    CVE-2026-62948

    OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

    OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, …

    openwrt openwrt
  • Critical 9.5
    CVE-2026-30872

    OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup

    OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for I…

    openwrt openwrt
  • Critical 9.5
    CVE-2026-30871

    OpenWrt Project has Stack-based Buffer Overflow in DNS PTR Query

    OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse…

    openwrt openwrt
  • Critical 9.3
    CVE-2024-54143

    openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection

    openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploitin…

    openwrt asu