Approved changes feed: RSS · Atom
cpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Openwrt (f96faf39-ea80-51de-ab00-c5c27e1349a3) |
|---|---|
| Product | Luci (0d57d064-1e9c-521d-b896-467c89bb92fd) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/openwrt/luci |
purl2cpe | 2026-06-01 10:17:17.730895 |
pkg:pypi/openwrt-luci-rpc |
purl2cpe | 2026-06-01 10:17:17.730897 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-62184 |
vulnerable | 2026-07-29 01:06:18.980436 |
luci-app-banip Log Monitor IP Extraction Bypass
HIGH (7.5)
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP address into the login username field, causing banIP to block the wrong target while the real attacker remains unblocked.
Published: 2026-07-13T21:30:09.248Z
Updated: 2026-07-15T18:45:50.565Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-61876 |
vulnerable | 2026-07-29 01:06:18.916409 |
LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting
HIGH (8.8)
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.
Published: 2026-07-12T12:07:55.788Z
Updated: 2026-07-14T22:03:45.641Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-61875 |
vulnerable | 2026-07-29 01:06:18.916156 |
luci-app-upnp Stored XSS via UPnP Port Mapping Description
HIGH (8.8)
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.
Published: 2026-07-12T12:06:36.956Z
Updated: 2026-07-14T22:03:44.956Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59260 |
vulnerable | 2026-07-29 01:03:17.449422 |
OpenWrt luci-app-samba4 read ACL remote code execution via smbd
HIGH (8.8)
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message command to a root smbd process, triggering command execution when SMB protocol messages are processed.
Published: 2026-07-12T12:06:35.592Z
Updated: 2026-07-14T22:03:27.226Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-58000 |
vulnerable | 2026-07-29 01:03:16.571579 |
luci-proto-openvpn - Command Injection via cl_meta Parameter in generateKey
HIGH (8.8)
luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI user with OpenVPN protocol configuration access can inject arbitrary shell metacharacters into cl_meta to execute commands as root via the popen function.
Published: 2026-06-29T18:16:04.973Z
Updated: 2026-07-14T21:34:47.833Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-57999 |
vulnerable | 2026-07-29 01:03:16.571116 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32721 |
vulnerable | 2026-06-08 07:57:18.078588 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51240 |
vulnerable | 2026-06-08 06:52:11.875655 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-27821 |
vulnerable | 2026-06-08 05:31:22.235616 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-12272 |
vulnerable | 2026-06-08 05:12:38.870919 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.