CVE-2026-32721 Details
Description
LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an attacker to craft a malicious SSID containing arbitrary HTML/JavaScript. Exploitation requires the user to actively open the wireless scan modal (e.g., to connect to a Wi-Fi access point or survey nearby channels), and only affects OpenWrt versions newer than 23.05/22.03 up to the patched releases (24.10.6 and 25.12.1). The issue has been fixed in version LuCI 26.072.65753~068150b.
A stored cross-site scripting vulnerability has been identified in the LuCI OpenWrt Configuration Interface, specifically in versions prior to 24.10.5 and 25.12.0. The issue arises in the wireless scan modal, where SSID values from scan results are displayed as raw HTML without any sanitization. This vulnerability is present in the wireless.js file of the luci-mod-network package, which passes SSIDs to the DOM using innerHTML, allowing an attacker to inject malicious HTML or JavaScript through specially crafted SSIDs. Exploitation requires the user to open the wireless scan modal, and the vulnerability affects OpenWrt versions newer than 23.05/22.03, up to the patched releases.
Users can upgrade to LuCI version 26.072.65753~068150b or later. OpenWrt users should upgrade to version 24.10.6, 25.12.1 or later, including snapshot builds since March 13, 2026.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openwrt luci | < 26.072.65753-068150b |
CPE
Remediation
| |
| openwrt openwrt | < 24.10.6 >= 25.12.0, < 25.12.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 14, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |