CVE-2025-57389

A reflected cross-site scripting XSS vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0...

CVE-2025-57389

A reflected cross-site scripting XSS vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0...

OpenWRT Luci LTS 安全漏洞

OpenWRT Luci LTS is an OpenWRT open source web management interface for Linux distributions. A security vulnerability exists in OpenWRT Luci LTS version v18.06.2, which originates from the presence of reflective cross-site scripting in the /admin/system/packages endpoint, which could lead to the...

CVE-2025-57389

A reflected cross-site scripting XSS vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0...

PT-2025-40300

Name of the Vulnerable Software and Affected Versions Luci OpenWRT version 18.06.2 Description A reflected cross-site scripting XSS issue exists in the /admin/system/packages API endpoint of Luci OpenWRT. An attacker can execute arbitrary Javascript in a user's browser by providing a crafted...

CVE-2025-57389: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0...

CVE-2025-57389

A reflected cross-site scripting (XSS) vulnerability exists in the Luci OpenWRT v18.06.2 web management interface, specifically on the /admin/system/packages (or /cgi-bin/luci/admin/system/packages) endpoint. The root cause is insufficient input sanitization , which allows an attacker to break ou...

CVE-2025-56706

Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution RCE vulnerability via the Object parameter in the openwrtgetConfig function...

CVE-2025-56706

Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution RCE vulnerability via the Object parameter in the openwrtgetConfig function...

CVE-2025-56706

Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution RCE vulnerability via the Object parameter in the openwrtgetConfig function...

CVE-2025-56706

Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution RCE vulnerability via the Object parameter in the openwrtgetConfig function...

CVE-2025-56706

The Edimax BR-6473AX wireless router, specifically version v1.0.28 , contains a remote code execution (RCE) vulnerability. The root cause is a flaw in the Object parameter within the openwrt_getConfig function, which allows for command injection (CWE-77). Exploitation of this vulnerability could ...

PT-2025-37920

Name of the Vulnerable Software and Affected Versions: Edimax BR-6473AX version 1.0.28 Description: The Edimax BR-6473AX version 1.0.28 contains a remote code execution RCE issue through the Object parameter within the openwrt getConfig function. Recommendations: At the moment, there is no...

CVE-2024-54143

openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious...

CVE-2024-51240

An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc package...

CVE-2023-38320

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a showpreauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS a Denial-of-Service condition. This problem...

CVE-2023-38314

An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated that can be triggered with a crafted GET HTTP request with a missing redirect query string parameter. Triggering this issue results in crashing OpenNDS a Denial-of-Servic...

CVE-2023-24182

LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting XSS vulnerability via the component /system/sshkeys.js...

CVE-2023-30312

An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service, impersonating the client to the server e.g., for access to files over FTP, and impersonating the server to the client e.g., to deliver...

CVE-2023-38324

An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence and directly authenticate when it is using the default FAS key and OpenNDS is configured as FAS. Affected OpenNDS Captive Portal before version 10.1.2 fixed in OpenWrt master, OpenWrt 23.05 and...