CVE-2026-32721 - Vulnerability Analysis

Overview

LuCI < 24.10.5 and < 25.12.0 contains a stored XSS caused by unsanitized SSID values rendered as raw HTML in the wireless scan modal, letting attackers execute arbitrary script when users open the modal.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in the user's browser, potentially stealing credentials or performing actions on behalf of the user.

Mitigation

Update to LuCI version 26.072.65753~068150b or later.

References

• https://github.com/openwrt/luci/commit/cdce600aaec66f762f18d608c74cbf3abcafe1c7
• https://github.com/openwrt/luci/security/advisories/GHSA-vvj6-7362-pjrw
• https://github.com/openwrt/luci/commit/068150ba5f524ef6b03817b258d31ec310053fd6

Social Media Activity(2 posts)

Lobsters

@lobsters

Mar 19, 2026

Root from the parking lot: OpenWRT XSS through SSID scanning (CVE-2026-32721) https://lobste.rs/s/vteijd #security https://mxsasha.eu/posts/openwrt-ssid-xss-to-root/

View original post

Lobsters

@lobsters

Mar 19, 2026

Root from the parking lot: OpenWRT XSS through SSID scanning (CVE-2026-32721) https://lobste.rs/s/vteijd #security https://mxsasha.eu/posts/openwrt-ssid-xss-to-root/

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner