Skip to content
OpenAdvisories

Vendor

openwrt

38 known vulnerabilities.

Products

luci 13 openwrt 13 odhcpd 5 uhttpd 3 luci-app-tailscale-community 1 luci-app-banip 1 asu 1 luci-app-adblock-fast 1 luci-app-travelmate 1 travelmate 1 luci-proto-openvpn 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-53921 Public exploit

    odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)

    odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to n…

    openwrt odhcpd
  • High 8.8
    CVE-2026-61876 Public exploit

    LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

    LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's brows…

    openwrt luci