luci‑app‑upnp contains a stored cross‑site scripting vulnerability that allows unauthenticated LAN clients to embed malicious JavaScript into the NewPortMappingDescription field of an UPnP IGD AddPortMapping SOAP request. The miniupnpd component stores the string without sanitization, and luci‑app‑upnp renders it unencoded on the web interface. When an administrator views the UPnP or status pages, the injected script executes in the administrator’s browser, enabling session hijacking, credential theft, or further payload installation.

The vulnerability affects the OpenWrt luci‑app‑upnp package. No specific version restriction is provided; therefore every installation that enables UPnP IGD AddPortMapping is potentially vulnerable. The impact surfaces in the web interface used to manage the router, which is accessed by administrators over the local network.

The CVSS base score of 8.7 indicates a high‑severity flaw that can undermine confidentiality, integrity, and availability of the administration session. The EPSS score of < 1 % suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from any device on the LAN that can issue AddPortMapping requests, making the local network the most likely attack vector. Based on the description, it is inferred that once the payload is stored, it will execute each time an administrator accesses the affected pages until the description is cleared or the flaw is patched.