CVE-2026-62948

CRÍTICO 9.6CVE-2026-62948 · Published 15/07/2026 · updated 21/07/2026

Em resumo

CVE-2026-62948 é uma vulnerabilidade CRÍTICO (CVSS 9.6).
Chance de exploração nos próximos 30 dias (EPSS): 0.58%, maior que 47.7% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

References

openwrt/luci commit 55379d0 · Patch
openwrt/odhcpd commit 68f3826 · Patch
openwrt/odhcpd#404 · Issue Tracking
openwrt/openwrt release v25.12.5 · Release Notes
openwrt/openwrt security advisory · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free