CyberRota Analysis
AI-GeneratedOpenWrt versions prior to 25.12.5 are vulnerable due to a flaw in the odhcpd DHCPv6 client that allows for newline injection in lease entries, potentially leading to the execution of arbitrary HTML and JavaScript in the Active DHCPv6 Leases admin page. This critical vulnerability, with a CVSS score of 9.6, could be exploited to conduct cross-site scripting (XSS) attacks, compromising the integrity of the web interface. Organizations using OpenWrt for embedded devices should prioritize upgrading to version 25.12.5 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)