OpenWrt up to 25.12.4 DHCPv6 Client FQDN Option src/statefiles.c statefiles_write_state6 Hostname injection

Summaryinfo

A vulnerability was found in OpenWrt up to 25.12.4. It has been rated as very critical. Impacted is the function statefiles_write_state6 of the file src/statefiles.c of the component DHCPv6 Client FQDN Option. This manipulation of the argument Hostname causes injection. This vulnerability is handled as CVE-2026-62948. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as very critical was found in OpenWrt up to 25.12.4. Affected by this vulnerability is the function statefiles_write_state6 of the file src/statefiles.c of the component DHCPv6 Client FQDN Option. The manipulation of the argument hostname with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-62948 since 07/15/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/15/2026). The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

Upgrading to version 25.12.5 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• OpenWrt

Version

• 25.12.0
• 25.12.1
• 25.12.2
• 25.12.3
• 25.12.4

Website

• Product: https://github.com/openwrt/openwrt/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion