The vulnerability is a stored XSS flaw in luci-app-adblock-fast versions prior to 1.2.4-4. A lower‑privileged user can insert malicious JavaScript into the blocklist name field. When an administrator later opens the AdBlock Fast status page, the injected payload executes in the browser with the LuCI origin, allowing the attacker to run arbitrary code while the admin is logged in. The script could read session cookies, capture keystrokes, or perform actions on behalf of the administrator.

Affected by OpenWrt’s Luci project component luci-app-adblock-fast. All releases earlier than 1.2.4-4 contain the flaw, including custom firmware builds that ship the package without the security patch.

The CVSS score of 5.1 indicates moderate severity. EPSS is unavailable, and the vulnerability is not in the CISA KEV catalog. Attackers most likely exploit the flaw via the user interface: a non‑privileged user creates or edits a blocklist entry, injecting code that is later rendered for an administrator. Because the code runs under the LuCI origin it can target administrative sessions but does not provide direct remote code execution on the device itself.