Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCmedium

[dos] LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

Exploit-DB ()2 · 1 read
Read at exploit-db.com
AI summary · glm-5.3Summaries by Vani AI

Stored cross-site scripting in OpenWrt LuCI via malicious DHCPv6 lease hostnames allows router interface attacks.

Exploit-DB entry 52637 describes a stored cross-site scripting vulnerability in LuCI, the OpenWrt web administration interface. A attacker on the local network can set a malicious hostname that gets stored in DHCPv6 lease data and rendered unsafely in the LuCI UI. When an administrator views the lease status page, the injected script executes in the router's management context.

Key facts
  • Stored XSS in LuCI via DHCPv6 lease hostname
  • Script runs in router admin interface context
  • Affects OpenWrt deployments with DHCPv6 enabled
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
dhcpv6luciopenwrtpocrouterxss

From the original article

Exploit-DB

exploit-db.com

Read the full article at Exploit-DB

This source shares headlines only. Summary, key facts and assessment above are AI-written from the article and can be wrong.