CVE-2026-62948
OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6() and statefileswritestate4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.
Package Versions Affected
Automatically patch vulnerabilities without upgrading
CVSS Version



Related Resources
References
https://github.com/openwrt/openwrt/releases/tag/v25.12.5, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62948.json, https://github.com/openwrt/openwrt/security/advisories/GHSA-hhmc-92hw-535f, https://nvd.nist.gov/vuln/detail/CVE-2026-62948, https://github.com/openwrt/luci/commit/55379d04fcc3c605003a5001d6135cf02ae6048a, https://github.com/openwrt/odhcpd/commit/68f382690bfaec56d5b1f31c3c31c48bcb642e3a, https://github.com/openwrt/odhcpd/pull/404