CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

• CWE-79
• CWE-117
• CWE-150

• https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048aPatch
• https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3aPatch
• https://github.com/openwrt/odhcpd/pull/404Issue Tracking, Patch
• https://github.com/openwrt/openwrt/releases/tag/v25.12.5Release Notes
• https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535fExploit, Mitigation, Vendor Advisory
• https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535fExploit, Mitigation, Vendor Advisory

Published

Jul 15, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6294The Google PageRank Display plugin for WordPress is vulnerab…4.3
• CVE-2026-62940Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-62941Incus is a system container and virtual machine manager. Pri…9.9
• CVE-2026-62945TREK is a collaborative travel planner. Prior to 3.1.3, TREK…4.3
• CVE-2026-62946ImageMagick is free and open-source software used for editin…4.7
• CVE-2026-62947OpenWrt is a Linux operating system targeting embedded devic…4.9
• CVE-2026-62959Coturn is a free open source implementation of TURN and STUN…8.2
• CVE-2026-6296Heap buffer overflow in ANGLE in Google Chrome prior to 147.…9.6
• CVE-2026-62960Git for Windows is the Windows port of Git. Prior to 2.55.0.…7.4
• CVE-2026-62963Centrifugo is an open-source scalable real-time messaging se…8.7
• CVE-2026-6297Use after free in Proxy in Google Chrome prior to 147.0.7727…8.3
• CVE-2026-6298Heap buffer overflow in Skia in Google Chrome prior to 147.0…4.3