Critical severity9.6NVD Advisory· Published Jul 15, 2026· Updated Jul 21, 2026

CVE-2026-62948

Description

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

Affected products

Openwrt/Openwrt2 versions
cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*range: <25.12.5
- (no CPE)range: <25.12.5
Openwrt/odhcpdllm-fuzzy
Range: <25.12.5

Patches

Vulnerability mechanics

References

github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048anvdPatch
github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3anvdPatch
github.com/openwrt/odhcpd/pull/404nvdIssue TrackingPatch
github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535fnvdExploitMitigationVendor Advisory
github.com/openwrt/openwrt/releases/tag/v25.12.5nvdRelease Notes

News mentions

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
The Hacker News · Jul 28, 2026

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000