dbcve.org
Cross-site Scripting (XSS)Weakness · CWE-79

CVE-2026-61876

HIGH · 8.8 CVSS v3.1 Published 2026-07-12
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
91/100
Remediation priority · Urgent
No privileges 6 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

LuCI (OpenWrt web interface) versions suffer from a stored Cross-Site Scripting (XSS) vulnerability in DHCPv6 lease status pages. The application fails to encode/sanitize DHCPv6 Client FQDN hostnames before rendering them in HTML tables, allowing adjacent network attackers to inject malicious script tags via DHCPv6 messages that execute when administrators view the lease status page.

MitigationUpgrade LuCI to a version that properly encodes DHCPv6 lease hostnames using HTML entity encoding before rendering. If no upgrade is available, implement upstream network filtering to block DHCPv6 messages containing suspicious FQDN payloads.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify LuCI is installed and identify its version
    Access the OpenWrt device via SSH and run: cat /usr/lib/luci/version | grep -i luci or cat /etc/config/luci | grep -i version. Alternatively, check the LuCI login page footer for version display.
    Affected if The installed LuCI version is not the patched version that properly encodes DHCPv6 FQDN hostnames in HTML tables.
  2. Confirm DHCPv6 service is enabled on the OpenWrt device
    Run: cat /etc/config/dhcp | grep -A5 'config dhcp lan' to check for 'option dhcp_option '6,' and verify DHCPv6 is configured. Also check for 'config dhcp 'ipv6'' sections.
    Affected if DHCPv6 is enabled and the device is assigning IPv6 addresses to clients, which populates the lease status page with client data.
  3. Locate the DHCPv6 lease file
    Run: ls -la /tmp/dhcp6.leases or cat /tmp/dhcp6.leases to view the DHCPv6 lease database file.
    Affected if The lease file exists and contains entries with Client FQDN hostnames that could contain unsanitized user-controlled data.
  4. Inspect DHCPv6 lease entries for unsanitized input
    Run: cat /tmp/dhcp6.leases and examine the hostname fields in each lease entry. Look for any HTML special characters (<, >, ', ", or JavaScript keywords) that would indicate injection attempts.
    Affected if Any DHCPv6 lease entry contains raw FQDN hostnames with unencoded HTML special characters that would execute if rendered in the LuCI DHCP status table.
  5. Verify access to LuCI DHCPv6 lease status page
    Log into LuCI as administrator and navigate to Network > DHCP and DNS > IP Renewals or similar DHCP lease status page that displays IPv6 leases and hostnames.
    Affected if The lease status page is accessible to administrators and displays DHCPv6 client hostnames without proper HTML encoding.

The environment is affected if LuCI is running with an unpatched version and DHCPv6 leases contain FQDN hostnames that render as unsanitized HTML in the lease status page.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Upgrade LuCI to a version that properly encodes DHCPv6 lease hostnames using HTML entity encoding before rendering. If no upgrade is available, implement upstream network filtering to block DHCPv6 messages containing suspicious FQDN payloads.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing4.0 h
  • Review / QA2.0 h
18.0 hours of engineering $3,200
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,120.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-61876 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-61876 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data