CVE-2026-61876
CRITICAL
INFO
Priority: 0.15
BB Relevance:
54/100
Published: 2026-07-12
Modified: 2026-10-24
First seen: 2026-10-29
Status: active
Attack Surface
Adjacent
Low Complexity
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
None
UI:
Passive
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.