These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The OpenWrt luci-app-dockerman package contains an OS command injection vulnerability due to broad ubus access granted by the package's read ACL. The vulnerability allows authenticated attackers to inject shell metacharacters and execute arbitrary commands as root via an HTTP POST to /ubus. This issue affects OpenWrt master and openwrt-25.12 snapshots with the ucode docker_rpc.uc RPC backend after the JS/ [truncated]
The luci-app-adblock-fast package before version 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field. This allows lower-privileged users to inject active HTML, which executes in the administrator's browser when viewing the AdBlock Fast status page. The vulnerability has a CVSS score of 5.1 and a severity rating of MEDIUM. To address this vulnerability, organizations sh [truncated]
The luci-app-https-dns-proxy package contains a stored cross-site scripting vulnerability in the resolver_url parameter. Authenticated users can inject active HTML, which is rendered as raw HTML and executes JavaScript in the administrator's browser origin when the HTTPS DNS Proxy status page is viewed. The vulnerability has a CVSS score of 6.8 and a severity of MEDIUM. The CVE record was published on 202 [truncated]
The cgi-download handler in OpenWrt's cgi-io package is vulnerable to path traversal attacks, allowing access to root-readable files. The vulnerability is fixed in OpenWrt version 25.12.5. Users should update to the latest version and review their systems for potential exposure. The issue arises from authorizing requested paths against the caller's ubus session file ACL before canonicalization, and the us [truncated]
OpenWrt, a Linux operating system for embedded devices, is vulnerable to a critical issue (CVSS Score: 9.6) allowing DHCPv6 client FQDN option 39 hostname injection. Prior to version 25.12.5, odhcpd writes unsanitized hostnames into /tmp/odhcpd.leases, enabling attackers to inject forged lease lines. This issue is fixed in version 25.12.5. The vulnerability exists in the odhcpd component of OpenWrt, speci [truncated]
CVE-2026-62184 luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real a [truncated]
The CVE record indicates that LuCI versions have a vulnerability where DHCPv6 lease hostnames are not properly encoded before being rendered in status tables. This allows adjacent network attackers to inject HTML markup by sending a DHCPv6 Client FQDN containing script tags. These script tags can execute in the administrator's browser when viewing DHCP lease pages. The vulnerability is critical, with a CV [truncated]
CVE-2026-61875 is a stored cross-site scripting vulnerability in luci-app-upnp. Unauthenticated LAN clients can inject JavaScript via UPnP IGD AddPortMapping SOAP requests by sending malicious HTML in the NewPortMappingDescription field. The payload executes when administrators view the UPnP or Status pages. This vulnerability has a high CVSS score of 8.7 and is considered a high-severity issue. Administr [truncated]
The OpenWrt luci-app-samba4 vulnerability allows authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments due to a read ACL granting file.exec permission on /usr/sbin/smbd. This enables attackers to pass arbitrary Samba global options, such as message command, to a root smbd process, potentially triggering command execution when SMB protocol messages are proc [truncated]
CVE-2026-55490 is an integer underflow vulnerability in OpenWrt's Emergency Access Daemon. Before v25.12.5, an unauthenticated attacker on the local network can crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed in v25.12.5. The vulnerability has a CVSS score of 6.5 and is class [truncated]