CVE-2026-61876CWE-79

LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

Critical · published July 12, 2026

CVSS v4.0
9.4
EPSS
1%
Percentile
69.7
In the wild
Unconfirmed
What it is

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01277 · 69.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-12T12:07Z
EPSS history
Timeline
  • 12 JUL 12:07Z
    LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
    cvelistv5