CVE-2026-61875 Details
Description
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.
A stored cross-site scripting vulnerability has been identified in the OpenWrt LuCI UPnP application, specifically in the 'master' version. This vulnerability allows unauthenticated LAN clients to inject JavaScript into UPnP IGD AddPortMapping SOAP requests. The injected HTML is not properly encoded before being displayed, leading to the execution of the script when an administrator accesses the UPnP or Status pages.
The vulnerability can be remediated by updating the affected JavaScript files to properly encode untrusted data before it is rendered. This can be done by wrapping the data in 'document.createTextNode()' or using array syntax to ensure it is treated as plain text rather than HTML. Additionally, regression tests should be added to verify that similar vulnerabilities do not reoccur.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 12, 2026CISA-ADP
Assessed Jul 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/luci-app-upnp-stored-xss-via-upnp-port-mapping-description | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenWrt LuCI-app-upnp | master |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | CVE Modified | CISA-ADP |
| Jul 12, 2026 | New CVE Received | [email protected] |