CVE-2026-62948

criticalCVSS 9.6covered by 1 sourcefirst seen 2026-07-15

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

⚡ Watch CVE-2026-62948

Get an email if CVE-2026-62948 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.58% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 45% of all EPSS-scored CVEs.

Advisory coverage (1)

criticalCVE-2026-62948: OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd write…nvd · 2026-07-15

External references

NVD record for CVE-2026-62948

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-62948 status](https://www.csirts.com/badge/CVE-2026-62948)](https://www.csirts.com/cve/CVE-2026-62948)