CVE-2026-32721Disclosure(openwrt / luci)

LOWCVSS 4.8 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch openwrt luci systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an attacker to craft a malicious SSID containing arbitrary HTML/JavaScript. Exploitation requires the user to actively open the wireless scan modal (e.g., to connect to a Wi-Fi access point or survey nearby channels), and only affects OpenWrt versions newer than 23.05/22.03 up to the patched releases (24.10.6 and 25.12.1). The issue has been fixed in version LuCI 26.072.65753~068150b.

openwrt CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

luci
openwrt

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
8 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 3 signals
Technical details provided in 8 signals
Disclosure: 4 classified signals
Peaked 1d ago at 5 mentions (2026-03-20); latest day: 1
8 total mentions across 3 days

Affected systems

Vendors

openwrt

Products

luciopenwrt

Deep dive

Activity timeline8 mentions / 3d

Signal classification3 categories

Disclosure

450.0%

Patch

225.0%

PoC

225.0%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-19	2	Disclosure1Patch1
2026-03-20	5	Disclosure3Patch1PoC1
2026-04-21	1	PoC1

Full discourse8 posts

CCB Alert@CCBalert204d
Disclosure
Warning: High severity Stored XSS in #LuCI the #OpenWrt Configuration Interface. CVE-2026-32721 CVSS: 8.6. Malicious SSIDs can inject arbitrary HTML/JavaScript via the wireless scan modal. #Patch #Patch #Patch
Post summary
The post warns of a high‑severity stored XSS vulnerability (CVE‑2026‑32721) in OpenWrt's LuCI interface, but does not provide any PoC, exploit code, active exploitation evidence, or patch details.
01000212
7.2K followersView on X
CVE@CVEnew204d
Disclosure
CVE-2026-32721 LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID val… https://www.cve.org/CVERecord?id=CVE-2026-32721
Post summary
An OpenWrt LuCI stored XSS flaw (CVE‑2026‑32721) affects versions older than 24.10.5 and 25.12.0, with no PoC, exploit code, or patch information provided.
00001176
56.8K followersView on X
Komodo Cyber Security@Komodosec171d
PoC
Root from the parking lot: OpenWRT XSS through SSID scanning (CVE-2026-32721) https://mxsasha.eu/posts/openwrt-ssid-xss-to-root/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet announces a new OpenWRT XSS vulnerability (CVE-2026-32721) that can lead to root via SSID scanning, providing a link to a blog post containing a proof‑of‑concept.
0000092
1.5K followersView on X
CCB Alert@CCBalert204d
Patch
Warning: High severity Stored XSS in #LuCI the #OpenWrt Configuration Interface. #CVE-2026-32721 CVSS: 8.6. Malicious SSIDs can inject arbitrary HTML/JavaScript via the wireless scan modal. #Patch #Patch #Patch
Post summary
High severity stored XSS (CVE‑2026‑32721) in OpenWrt’s LuCI interface allows arbitrary HTML/JavaScript injection via the wireless scan modal; a patch is available.
00000188
7.2K followersView on X
TRONCAL Yannick@ytroncal204d
PoC
Root from the parking lot: OpenWRT XSS through SSID scanning (CVE-2026-32721) https://mxsasha.eu/posts/openwrt-ssid-xss-to-root/
Post summary
The linked post provides a Proof of Concept for CVE-2026-32721, an XSS flaw in OpenWRT discovered through SSID scanning, though no patch or active exploitation is reported.
0000061
137 followersView on X
Infoflowcloud@infoflowcloud204d
Disclosure
🚨*CVE* CVE-2026-32721 LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID val… https://www.cve.org/CVERecord?id=CVE-2026-32721 ----- Traducción: CVE-2026-32721 LuC… http://infoflow.cloud`
Post summary
The post discloses a stored XSS vulnerability in OpenWrt LuCI before 24.10.5/25.12.0, affecting the wireless scan modal, and indicates that newer releases contain the fix.
0000056
61 followersView on X
CVEFind.com@CveFindCom204d
Patch
[CVE-2026-32721: HIGH] Vulnerability in LuCI interface, found in OpenWrt versions before 24.10.5 and 25.12.0, allows XSS attacks via crafted SSIDs in wireless scan modal, fixed in LuCI 26.072.65753~068150b.#cve,CVE-2026-32721,#cybersecurity https://cvefind.com/CVE-2026-32721
Post summary
The post announces a high‑severity XSS vulnerability in OpenWrt LuCI (CVE‑2026‑32721) and confirms that a patch is available in LuCI 26.072.65753~068150b.
0000070
603 followersView on X
The Hacker Wire@TheHackerWire204d
Disclosure
🟠 CVE-2026-32721 - High LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are... https://www.thehackerwire.com/vulnerability/CVE-2026-32721/ https://t.co/apKHrxa4QD
Post summary
The tweet announces a stored XSS flaw (CVE‑2026‑32721) in LuCI’s wireless scan modal affecting pre‑24.10.5 and 25.12.0 versions, providing technical details but no PoC, exploit, or patch information.
0000058
137 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	openwrt	luci	-	-	-
OS	openwrt	openwrt	-	-	-

Explore more

Back to dashboard openwrt CVEs luci vulnerabilities

What researchers are saying

CVE-2026-32721

Komodo Cyber Security[verified]@KomodosecPoC

The tweet announces a new OpenWRT XSS vulnerability (CVE-2026-32721) that can lead to root via SSID scanning, providing a link to a blog post containing a proof‑of‑concept.

CCB Alert@CCBalertDisclosure

The post warns of a high‑severity stored XSS vulnerability (CVE‑2026‑32721) in OpenWrt's LuCI interface, but does not provide any PoC, exploit code, active exploitation evidence, or patch details.

CVE@CVEnewDisclosure

An OpenWrt LuCI stored XSS flaw (CVE‑2026‑32721) affects versions older than 24.10.5 and 25.12.0, with no PoC, exploit code, or patch information provided.

CCB Alert@CCBalertPatch

High severity stored XSS (CVE‑2026‑32721) in OpenWrt’s LuCI interface allows arbitrary HTML/JavaScript injection via the wireless scan modal; a patch is available.

TRONCAL Yannick@ytroncalPoC

The linked post provides a Proof of Concept for CVE-2026-32721, an XSS flaw in OpenWRT discovered through SSID scanning, though no patch or active exploitation is reported.

Infoflowcloud@infoflowcloudDisclosure

The post discloses a stored XSS vulnerability in OpenWrt LuCI before 24.10.5/25.12.0, affecting the wireless scan modal, and indicates that newer releases contain the fix.

CVEFind.com@CveFindComPatch

The post announces a high‑severity XSS vulnerability in OpenWrt LuCI (CVE‑2026‑32721) and confirms that a patch is available in LuCI 26.072.65753~068150b.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces a stored XSS flaw (CVE‑2026‑32721) in LuCI’s wireless scan modal affecting pre‑24.10.5 and 25.12.0 versions, providing technical details but no PoC, exploit, or patch information.