CVE-2026-61876LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

Beschreibung

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-686p-p8p9-x6fh) vendor-advisory
• VulnCheck Advisory: LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting third-party-advisory