A stored XSS flaw exists in the LuCI wireless scan modal. SSIDs returned from a scan are inserted into the page via a template literal that feeds raw text into innerHTML without sanitization. An attacker can broadcast a rogue access point with a malicious SSID that contains arbitrary HTML or JavaScript, which will be rendered when a user opens the scan modal and the page processes the SSID. This can lead to session hijacking, credential theft, or arbitrary code execution with the privileges of the logged‑in user.

The vulnerability affects OpenWrt LuCI installations that use the luci-mod-network package and run LuCI versions earlier than 24.10.5 or 25.12.0. It applies to OpenWrt releases newer than 23.05/22.03 up to the patched releases 24.10.6, 25.12.1, and subsequently to any newer builds that include the LuCI 26.072.65753~068150b update. Devices running these openwrt releases are therefore impacted unless updated.

The CVSS score is 8.6, categorising the issue as high severity. Exploitation requires human interaction: the victim must open the wireless scan modal while connected to or within range of an access point broadcasting a malicious SSID. The EPSS probability is below 1 %, indicating a low likelihood of immediate widespread use. The flaw is not currently listed in the CISA KEV catalog. Attackers would need to control SSID broadcasting and motivate the user to open the scan modal, making exploitation more complex but still feasible in targeted scenarios.