VulnSocial

CVE-2026-61876Disclosure

LOWCVSS 9.4 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-07-12); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-12: 2Mentions · 2026-07-15: 1Mentions · 2026-07-16: 1PoC Mentioned / Linked · 2026-07-16: 1Technical Details · 2026-07-12: 2Technical Details · 2026-07-15: 1Technical Details · 2026-07-16: 107-1207-1507-16
Signal classification2 categories
Disclosure
375.0%
PoC
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-122
Disclosure2
2026-07-151
Disclosure1
2026-07-161
PoC1
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-61876 LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers c… https://www.cve.org/CVERecord?id=CVE-2026-61876

    Post summary

    The text discloses an XSS vulnerability in LuCI where improper encoding of DHCPv6 lease hostnames allows HTML injection, but it does not provide PoC, exploit code, patch, or evidence of active exploitation.

    00010878
    57.8K followersView on X
  • ThreatAft@ThreatAft
    PoC

    🚨 OpenWrt/LuCI 3-CVE Cluster — RCE + XSS in Router Management UI CVE-2026-59260 (8.8) — Samba4 ACL → root RCE CVE-2026-61875 (8.8) — UPnP stored XSS CVE-2026-61876 (8.8) — DHCPv6 hostname stored XSS → http://threataft.com/articles/openwrt-luci-cve-cluster-rce-xss #CyberSecurity #ThreatIntel #OpenWrt #IoTsecurity

    Post summary

    The tweet announces critical RCE and XSS vulnerabilities in OpenWrt/LuCI, providing a link that likely contains PoC details.

    0000072
    34 followersView on X
  • DFIR Lab@DFIR_Lab
    Disclosure

    🚨 HIGH SEVERITY: CVE-2026-61876 (CVSS 8.8) LuCI DHCPv6 hostname XSS vulnerability allows adjacent attackers to inject malicious HTML/script tags via crafted FQDN. Executes in admin browser when viewing DHCP leases. #CVE #Vulnerability #PatchNow https://t.co/DJ3nuLhS0c

    Post summary

    The tweet discloses a high‑severity XSS vulnerability (CVE‑2026‑61876) in LuCI DHCPv6, noting attack vector and impact but providing no PoC, exploit code, or patch details.

    0000040
    75 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-61876 LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers c… https://www.cve.org/CVERecord?id=CVE-2026-61876 ----- Traducción: CVE-2026-61876 Las… http://infoflow.cloud`

    Post summary

    CVE‑2026‑61876 describes a vulnerability in LuCI where DHCPv6 lease hostnames are not properly encoded, enabling HTML injection by adjacent network attackers.

    0000040
    92 followersView on X

Explore more

Back to dashboard