PT-2026-57559 · Openwrt · Luci-App-Upnp

Lujiefsi · Published 2026-07-12 · Updated 2026-07-12 · CVE-2026-61875

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions luci-app-upnp (affected versions not specified)

Description Stored cross-site scripting occurs when unauthenticated LAN clients inject JavaScript through UPnP IGD AddPortMapping SOAP requests. The issue arises because the NewPortMappingDescription field can contain malicious HTML, which is stored by miniupnpd and subsequently rendered by luci-app-upnp without output encoding. This allows the payload to execute when administrators access the UPnP or Status pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-61875

Affected Products

Luci-App-Upnp

References · 5

• https://github.com/openwrt/luci/security/advisories/GHSA-8v49-6387-7f89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-61875 · Security Note
• https://vulncheck.com/advisories/luci-app-upnp-stored-xss-via-upnp-port-mapping-description · Note
• https://twitter.com/infoflowcloud/status/2076341011538739663 · Twitter Post
• https://twitter.com/CVEnew/status/2076339906016637107 · Twitter Post