OpenWrt vulnerabilities
We track 58 vulnerabilities in OpenWrt products across 10 products. 58 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest OpenWrt vulnerabilities
- 9.8 Critical severity
odhcpd: Stack-based Buffer Overflow
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to ne
- 8.7 High severity
odhcpd: Out-of-bounds Read
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header t
- 8.8 High severity
odhcpd: Use After Free
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA handler keeps a per-message `first` lease pointer so multiple IA options in one message reuse the same Reconfigure authentication key. A D
- 8.8 High severity
luci: Improper Neutralization of Special Elements used in an OS Command
luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI. Prior to 1.1.2-6, the luci-app-advanced-reboot re
- 8.8 High severity
luci-app-adblock-fast: Improper Neutralization of CRLF Sequences
luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound. Prior to 1.2.4-2, the luci.adblock-fast.setCronEntry RPC method accepts an entry argument containing carriage-return or line-fee
- 9.9 Critical severity
luci: External Control of File Name or Path
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via `/.%2E` in the `lxc_name` p
- 9.9 Critical severity
luci: External Control of File Name or Path
luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persis
- 8.8 High severity
luci: Incorrect Privilege Assignment
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitr
- 8.8 High severity
luci: Improper Neutralization of Special Elements used in an OS Command
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / dock
- 7.5 High severity
luci: Improper Limitation of a Pathname to a Restricted Directory
OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directo
- 7.6 High severity
luci: Improper Neutralization of Input During Web Page Generation
luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_url parameter that allows authenticated users to inject active HTML. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw
- 9.6 Critical severity
openwrt: Improper Neutralization of Input During Web Page Generation
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, a
- 7.5 High severity
luci-app-banip: Improper Encoding or Escaping of Output
luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthentic
- 8.8 High severity
luci: Improper Neutralization of Input During Web Page Generation
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browse
- 8.8 High severity
luci: Improper Neutralization of Input During Web Page Generation
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd
- 8.8 High severity
luci: Improper Privilege Management
OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-line arguments. Attackers can pass arbitrary Samba global options such as message
- 7.5 High severity
luci-app-travelmate: Improper Neutralization of Special Elements used in an OS Command
luci-app-travelmate (and the travelmate package) contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-lo
- 8.8 High severity
luci-proto-openvpn: Improper Neutralization of Special Elements used in an OS Command
luci-proto-openvpn through 0.11.1, fixed in commit e4ff45e, contains a command injection vulnerability in the generateKey ubus method where the cl_meta parameter is interpolated into a shell command without proper escaping or quoting. An authenticated LuCI use
- 8.8 High severity
luci-app-tailscale-community: Improper Neutralization of Special Elements used in an OS Command
luci-app-tailscale-community contains a command injection vulnerability in the tailscale.do_login RPC method that allows authenticated users to execute arbitrary commands as root. The vulnerability exists because user-controlled loginserver and loginserver_aut
- 7.8 High severity
openwrt: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially le
- 9.8 Critical severity
openwrt: Stack-based Buffer Overflow
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for IP
- 9.8 Critical severity
openwrt: Stack-based Buffer Overflow
OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse
- 8.8 High severity
MediaTek chipset: Out-of-bounds Write
In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patc
- 8.8 High severity
MediaTek chipset: Out-of-bounds Write
In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCN
- 8.0 High severity
MT6890, MT7603, MT7615, MT7622, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435343; Issue
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435349; Issue
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00441509; Issue
- 7.8 High severity
openwrt: Heap-based Buffer Overflow
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in
- 8.8 High severity
OpenWrt Project is a Linux operating system targeting embedded devices.
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only eff
- 8.8 High severity
MT6890, MT7603, MT7615, MT7622, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 8.8 High severity
MT6890, MT7603, MT7615, MT7622, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00419945; Issue
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch
- 7.8 High severity
MT6890, MT7615, MT7622, MT7663, MT7915…: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch
- 8.8 High severity
MT6990, MT7990, MT7991, MT7992, MT7993: Heap-based Buffer Overflow
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 8.8 High severity
MT6890, MT7916, MT7981, MT7986: Out-of-bounds Write
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.