Technical impact
OpenWrt’s odhcpd daemon writes the DHCPv6 client FQDN option (option 39) into the lease file /tmp/odhcpd.leases without escaping. If the client supplies a hostname that contains a newline, the resulting lease file contains forged lease lines that are later rendered as raw HTML by the LuCI web interface. This allows an attacker that can send a crafted DHCPv6 request to inject arbitrary HTML into the Active DHCPv6 Leases page, resulting in a stored cross‑site scripting (XSS) vulnerability. The flaw is a classic input‑validation and output‑encoding weakness, reflected in the CWE‑117 and CWE‑79 identifiers.
Affected Systems
All OpenWrt installations running the default odhcpd package and LuCI web interface, including any version prior to 25.12.5, are affected. The problem originates in odhcpd’s state‑file generation code (statefiles_write_state6 and statefiles_write_state4) and the LuCI RPC module that displays the leases. The vulnerability was fixed in OpenWrt 25.12.5 and all subsequent releases.
Risk and Exploitability
The CVSS score of 9.6 signals a high‑severity flaw that allows arbitrary script execution in the browser of anyone who views the page. The EPSS score <1 % indicates that exploitation in the wild is currently rare. The vulnerability is not listed in CISA’s KEV catalog. Attackers need only transmit a specially crafted DHCPv6 request that contains a newline in the FQDN field; no additional authentication or higher‑level privileges are required. If the network allows DHCPv6 traffic from untrusted devices, the attacker can reach the router directly.
