CVE-2021-32019

—

CVSS 3.1

6.1 medium

EPSS

<1%p46

Published

Aug 2, 2021 (Aug 2, 2021)

Modified

Jun 17, 2026

Description

There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS, which can be used to gain full control over the affected system via ICMP.

Vendors: openwrt
Products: openwrt
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news0 stories

No ingested article mentions this CVE yet.