CVE-2026-62948 openwrt CVE debrief

Who should care

Administrators and users of OpenWrt, especially those managing network infrastructure, should prioritize patching to prevent potential exploitation. This includes reviewing and monitoring DHCPv6 lease configurations for suspicious activity and implementing additional input validation and sanitization for DHCPv6 hostnames.

Technical summary

The vulnerability exists in the odhcpd component of OpenWrt, specifically in the statefiles_write_state6() and statefiles_write_state4() functions. These functions write DHCPv6 client FQDN option 39 hostnames into /tmp/odhcpd.leases without proper escaping. This allows attackers to inject newline characters and forge lease lines, which are then displayed in the Active DHCPv6 Leases admin page of LuCI.

Defensive priority

High

Recommended defensive actions

• Apply the patch by updating OpenWrt to version 25.12.5 or later
• Review and monitor DHCPv6 lease configurations for suspicious activity
• Implement additional input validation and sanitization for DHCPv6 hostnames
• Consider using compensating controls such as firewall rules to limit access to the LuCI admin interface
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record was published on 2026-07-15T18:16:50.293Z and was last modified on 2026-07-21T16:06:30.357Z. The NVD entry is currently Analyzed. There is limited information available about the specific details of the vulnerability and its potential impact. Further verification and review of the affected systems and potential mitigations are necessary.

Official resources