CVE-2026-32721 - Vulnerability Analysis

Overview

LuCI < 24.10.5 and < 25.12.0 contains a stored XSS caused by unsanitized SSID values rendered as raw HTML in the wireless scan modal, letting attackers execute arbitrary script when users open the modal.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in the user's browser, potentially stealing credentials or performing actions on behalf of the user.

Mitigation

Update to LuCI version 26.072.65753~068150b or later.

References

• https://github.com/openwrt/luci/security/advisories/GHSA-vvj6-7362-pjrw
• https://github.com/openwrt/luci/commit/068150ba5f524ef6b03817b258d31ec310053fd6
• https://github.com/openwrt/luci/commit/cdce600aaec66f762f18d608c74cbf3abcafe1c7

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 19, 2026

🟠 CVE-2026-32721 - High (8.6) LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wire... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32721/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner