openwrt luci vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Latest openwrt luci vulnerabilities

CVE-2026-55897 — luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root (CVSS 8.8)
CVE-2026-72842 — OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass (CVSS 9.9)
CVE-2026-72841 — luci-app-openvpn Path Traversal RCE via instance_name2 (CVSS 9.9)
CVE-2026-72840 — OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write (CVSS 8.8)
CVE-2026-69096 — OpenWrt luci-app-dockerman Read ACL Remote Code Execution (CVSS 8.8)
CVE-2026-68583 — luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name (CVSS 5.4)
CVE-2026-67352 — luci-app-https-dns-proxy Stored XSS via resolver_url (CVSS 7.6)
CVE-2026-61876 — LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting (CVSS 8.8)
CVE-2026-61875 — luci-app-upnp Stored XSS via UPnP Port Mapping Description (CVSS 8.8)
CVE-2026-59260 — OpenWrt luci-app-samba4 read ACL remote code execution via smbd (CVSS 8.8)
CVE-2026-32721 — LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal (CVSS 4.8)
CVE-2024-51240 — (CVSS 8.0)
CVE-2023-24181 — (CVSS 5.4)
CVE-2022-41435 — (CVSS 5.4)
CVE-2021-27821 — (CVSS 6.1)
CVE-2020-10871 — (CVSS 5.3)
CVE-2019-12272 — (CVSS 9.8)