CVE-2026-62948

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 25.12.5

Description The odhcpd component writes a DHCPv6 client FQDN option 39 hostname into the /tmp/odhcpd.leases file via the statefiles write state6() and statefiles write state4() functions without proper escaping. This allows for newline injection of forged lease lines. These forged lines are subsequently rendered as live HTML in the Active DHCPv6 Leases admin page by dom.append through htdocs/luci-static/resources/view/status/include/40 dhcp.js and htdocs/luci-static/resources/luci.js via the rpcd-mod-luci getDHCPLeases endpoint.

Recommendations Update OpenWrt to version 25.12.5.