CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

• CWE-79
• CWE-117
• CWE-150

• https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048aPatch
• https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3aPatch
• https://github.com/openwrt/odhcpd/pull/404Issue Tracking, Patch
• https://github.com/openwrt/openwrt/releases/tag/v25.12.5Release Notes
• https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535fExploit, Mitigation, Vendor Advisory
• https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535fExploit, Mitigation, Vendor Advisory

Published

Jul 15, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6290Velociraptor versions prior to 0.76.3 contain a vulnerabilit…9.1
• CVE-2026-6291Bleichenbacher padding oracle in PKCS#7 KTRI decryption. Whe…6.5
• CVE-2026-6292The MP Customize Login Page plugin for WordPress is vulnerab…4.3
• CVE-2026-6293The Inquiry Form to Posts or Pages plugin for WordPress is v…4.3
• CVE-2026-6294The Google PageRank Display plugin for WordPress is vulnerab…4.3
• CVE-2026-62947OpenWrt is a Linux operating system targeting embedded devic…4.9
• CVE-2026-6296Heap buffer overflow in ANGLE in Google Chrome prior to 147.…9.6
• CVE-2026-62963Centrifugo is an open-source scalable real-time messaging se…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3
• CVE-2026-6299Use after free in Prerender in Google Chrome prior to 147.0.…8.8
• CVE-2026-62994CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14…3.7