CVE-2026-32721
Description
LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an attacker to craft a malicious SSID containing arbitrary HTML/JavaScript. Exploitation requires the user to actively open the wireless scan modal (e.g., to connect to a Wi-Fi access point or survey nearby channels), and only affects OpenWrt versions newer than 23.05/22.03 up to the patched releases (24.10.6 and 25.12.1). The issue has been fixed in version LuCI 26.072.65753~068150b.
How to fix
- openwrt luci26.072.65753-068150b or later
- openwrt openwrt24.10.6, 25.12.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openwrt luci | v < 26.072.65753-068150b | 26.072.65753-068150b |
| openwrt openwrt | v < 24.10.6, 25.12.0 ≤ v < 25.12.1 | 24.10.6, 25.12.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.