Security readout for executives and security teams
Plain-English summary
CVE-2026-61875 is a stored cross-site scripting flaw in OpenWrt LuCI’s UPnP app. A device on the local network can save malicious content in a UPnP port mapping description. When an administrator views affected LuCI UPnP or Status pages, that content can run in the admin’s browser.
Executive priority
Treat as high priority for managed OpenWrt routers, especially in networks with untrusted LAN clients. Risk depends on UPnP being enabled and administrator interaction, but impact can include admin-session compromise.
Technical view
luci-app-upnp renders the UPnP NewPortMappingDescription value without output encoding. Unauthenticated LAN clients can submit malicious HTML through UPnP IGD AddPortMapping requests; miniupnpd stores it, and LuCI later displays it. The CVSS 3.1 score is 8.8 with adjacent-network attack vector, no privileges, and required user interaction.
Likely exposure
Exposure is most likely on OpenWrt devices using LuCI with luci-app-upnp and UPnP enabled for LAN clients. The provided sources do not list affected or fixed version ranges.
Exploitation context
The attacker needs LAN adjacency and an administrator must view the affected LuCI page. The source bundle does not indicate CISA KEV listing or active exploitation.
Researcher notes
Evidence supports stored XSS via UPnP mapping descriptions in luci-app-upnp. The bundle names CWE-79, CVSS 8.8, and no KEV status. It does not provide version ranges, patch commits, or confirmed exploitation.
Mitigation direction
- Check the OpenWrt LuCI security advisory for fixed versions or package updates.
- Update LuCI/luci-app-upnp when vendor-fixed packages are available.
- Disable UPnP if it is not operationally required.
- Restrict untrusted devices from LAN segments that can reach UPnP services.
Validation and detection
- Inventory OpenWrt devices with LuCI and luci-app-upnp installed.
- Confirm whether UPnP is enabled and reachable from client LANs.
- Review existing UPnP mapping descriptions for unexpected markup or script-like content.
- Verify vendor guidance identifies your installed version as fixed or unaffected.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-61875 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H2.16VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-8v49-6387-7f89)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: luci-app-upnp Stored XSS via UPnP Port Mapping DescriptionCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.