LuCI DHCPv6 - Lease Hostname Stored Cross-Site Scripting

ExploitDBExploitDB exploitExploitEDB-52637

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends crafted DHCPv6 messages containing a malicious hostname in the Client FQDN option (option 39) to inject a stored XSS payload into the LuCI web interface of OpenWrt.

Backdoor review

No backdoor observed in reviewed code

The supplied Python script is a proof-of-concept for CVE-2026-61876, a stored XSS vulnerability in LuCI DHCPv6 lease hostname handling. It constructs and sends DHCPv6 messages with a user-supplied hostname payload to a target server. The code performs only the advertised DHCPv6 interaction; no backdoor, persistence, credential theft, unrelated remote access, or concealed harmful behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareOpenWrt LuCIodhcpd
Attack typesstored cross-site scripting
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively constructs and transmits malicious DHCPv6 network packets to inject a stored XSS payload into a target system. This is code intended to exercise a vulnerability, not merely detect it.

exploits/multiple/dos/52637.py:1exploits/multiple/dos/52637.py:15exploits/multiple/dos/52637.py:17exploits/multiple/dos/52637.py:23exploits/multiple/dos/52637.py:183-189

Requirements

  • Adjacent network access (LAN) to the target OpenWrt device.exploits/multiple/dos/52637.py:32
  • An administrator must view the DHCP lease status page in LuCI to trigger the payload.exploits/multiple/dos/52637.py:33

Observed behavior

  • Constructs and sends a DHCPv6 Solicit message containing a user-supplied hostname in the Client FQDN option.exploits/multiple/dos/52637.py:183-189
  • Processes the DHCPv6 Advertise response to extract the server ID and IA_NA options.exploits/multiple/dos/52637.py:190-198
  • Sends a DHCPv6 Request message to confirm the lease, again including the malicious FQDN.exploits/multiple/dos/52637.py:203-211
  • Optionally sends a DHCPv6 Release message to release the acquired lease.exploits/multiple/dos/52637.py:220-228
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
Sends DHCPv6 Solicit, Request, and optionally Release messages to a user-specified server (default ff02::1:2) on port 547This is the expected behavior for a DHCPv6 client PoC exploiting a hostname injection vulnerability.exploits/multiple/dos/52637.py:183-189exploits/multiple/dos/52637.py:203-211exploits/multiple/dos/52637.py:220-228
Payload Injection
User-supplied hostname is encoded as a DHCPv6 FQDN option (option 39) and included in DHCPv6 messagesThis directly implements the described XSS attack vector by injecting the payload into the DHCPv6 lease hostname field.exploits/multiple/dos/52637.py:176exploits/multiple/dos/52637.py:188exploits/multiple/dos/52637.py:210
Review boundaries

What the analysis did not establish

  • Only the single Python file from the ExploitDB entry was analyzed; no external libraries or referenced resources were expanded.
  • The code was not executed; classification is based solely on static analysis of the source code and its stated purpose.
  • Only the single Python file was reviewed; no external dependencies or runtime environment were inspected.
  • The script's effect depends on the target server's behavior, which is outside the scope of this review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1