Openwrt vulnerabilities
38 CVEs and advisories name Openwrt as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-55614uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
- CVE-2026-55612uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
- CVE-2026-55613uhttpd: HTTP request smuggling via ubus POST body parse-error desync
- CVE-2026-55606odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()
- CVE-2026-53918odhcpd DHCPv6 IA dangling first pointer use-after-free
- CVE-2026-53920odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
- CVE-2026-53921odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
- CVE-2026-53922odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)
- CVE-2026-55897luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
- CVE-2026-55159luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
- CVE-2026-62381luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow
- CVE-2026-72842OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
- CVE-2026-72841luci-app-openvpn Path Traversal RCE via instance_name2
- CVE-2026-72840OpenWrt LuCI luci-mod-system-mounts ACL Root RCE via Crontab Write
- CVE-2026-69096OpenWrt luci-app-dockerman Read ACL Remote Code Execution
- CVE-2026-69095OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
- CVE-2026-68583luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name
- CVE-2026-67352luci-app-https-dns-proxy Stored XSS via resolver_url
- CVE-2026-62947OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download
- CVE-2026-62948OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI
- CVE-2026-62184luci-app-banip Log Monitor IP Extraction Bypass
- CVE-2026-61876LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
- CVE-2026-61875luci-app-upnp Stored XSS via UPnP Port Mapping Description
- CVE-2026-59260OpenWrt luci-app-samba4 read ACL remote code execution via smbd
- CVE-2026-55490OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service
- CVE-2026-58652luci-app-travelmate - Arbitrary Command Execution via UCI Script Parameter
- CVE-2026-58000luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey
- CVE-2026-57999luci-app-tailscale-community - Command Injection via tailscale.do_login RPC
- CVE-2026-32721LuCI luci-mod-network: Possible XSS attack in WiFi scan on Joining Wireless Client modal
- CVE-2026-30874OpenWrt procd PATH Environment Variable Filter Bypass via Incorrect String Comparison Leads to Privilege Escalation