PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-62948 openwrt CVE debrief

OpenWrt, a Linux operating system for embedded devices, is vulnerable to a critical issue (CVSS Score: 9.6) allowing DHCPv6 client FQDN option 39 hostname injection. Prior to version 25.12.5, odhcpd writes unsanitized hostnames into /tmp/odhcpd.leases, enabling attackers to inject forged lease lines. This issue is fixed in version 25.12.5. The vulnerability exists in the odhcpd component of OpenWrt, specifically in the statefiles_write_state6() and statefiles_write_state4() functions. These functions write DHCPv6 client FQDN option 39 hostnames into /tmp/odhcpd.leases without proper escaping.

Vendor
openwrt
Product
Unknown
CVSS
CRITICAL 9.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-15
Original CVE updated
2026-07-21
Advisory published
2026-07-15
Advisory updated
2026-07-21

Who should care

Administrators and users of OpenWrt, especially those managing network infrastructure, should prioritize patching to prevent potential exploitation. This includes reviewing and monitoring DHCPv6 lease configurations for suspicious activity and implementing additional input validation and sanitization for DHCPv6 hostnames.

Technical summary

The vulnerability exists in the odhcpd component of OpenWrt, specifically in the statefiles_write_state6() and statefiles_write_state4() functions. These functions write DHCPv6 client FQDN option 39 hostnames into /tmp/odhcpd.leases without proper escaping. This allows attackers to inject newline characters and forge lease lines, which are then displayed in the Active DHCPv6 Leases admin page of LuCI.

Defensive priority

High

Recommended defensive actions

  • Apply the patch by updating OpenWrt to version 25.12.5 or later
  • Review and monitor DHCPv6 lease configurations for suspicious activity
  • Implement additional input validation and sanitization for DHCPv6 hostnames
  • Consider using compensating controls such as firewall rules to limit access to the LuCI admin interface
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-15T18:16:50.293Z and was last modified on 2026-07-21T16:06:30.357Z. The NVD entry is currently Analyzed. There is limited information available about the specific details of the vulnerability and its potential impact. Further verification and review of the affected systems and potential mitigations are necessary.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-62948 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-62948

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-62948 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-62948

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.