CVE-2026-62948

Analyzed Analyzed - Analysis Complete

Newline Injection in OpenWrt DHCP Leases via odhcpd

Publication date: 2026-07-15

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-21

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-62948

EUVD

EUVD-2026-44748

Affected Vendors & Products

Vendor	Product	Version / Range
openwrt	openwrt	to 25.12.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-117	The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenWrt's odhcpd DHCP server allows unauthenticated clients to inject malicious hostnames containing newlines or spaces into DHCP lease files. The hostnames are written without proper escaping, creating forged lease records. When displayed in LuCI's admin interface, this can lead to stored cross-site scripting (XSS) attacks due to missing HTML sanitization.

Detection Guidance

Check if your OpenWrt version is below 25.12.5 by running 'opkg list-installed | grep odhcpd' and 'cat /etc/openwrt_version'. Inspect lease files for unexpected entries with 'cat /tmp/odhcpd.leases' and monitor LuCI admin pages for unusual lease entries.

Impact Analysis

An attacker on the local network could exploit this to spoof DHCP leases, manipulate admin UI pages, or execute arbitrary JavaScript in the context of the OpenWrt admin interface. This could allow theft of session cookies, unauthorized access, or further network compromise.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to admin interfaces, potentially exposing sensitive network configuration data. It may also facilitate data breaches through XSS attacks, impacting GDPR's integrity principle or HIPAA's access controls.

Mitigation Strategies

Upgrade OpenWrt to version 25.12.5 or later immediately. If upgrading is not possible, disable DHCPv6 temporarily or restrict network access to trusted clients until patched.

Hi! I’m here to help you understand CVE-2026-62948. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70