Stored XSS Vulnerability in OpenWrt LuCI Configuration Interface
CVE-2026-32721
What is CVE-2026-32721?
The LuCI Configuration Interface in OpenWrt versions before 24.10.5 and 25.12.0 contains a stored XSS vulnerability in the wireless scan modal. This occurs due to inadequate sanitization of SSID values that are rendered as raw HTML. Specifically, the 'wireless.js' file within the luci-mod-network package processes SSIDs without proper escaping, enabling an attacker to inject arbitrary HTML/JavaScript. Users must actively open the wireless scan modal to exploit this vulnerability when connecting to Wi-Fi access points or surveying channels. The issue affects OpenWrt versions from 23.05 and 22.03 up to the specified patched versions (24.10.6 and 25.12.1), and has been remedied in LuCI version 26.072.65753~068150b.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
luci < 26.072.65753~068150b
openwrt < 24.10.6 < 24.10.6
openwrt >= 25.12.0, < 25.12.1 < 25.12.0, 25.12.1