CVE-2025-57389

MEDIUM

Luci OpenWRT <v19.07.0 - XSS

Title source: llm

Description

A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload. This vulnerability was fixed in OpenWRT v19.07.0.

Exploits (1)

nomisec WRITEUP

by amalcew · poc

https://github.com/amalcew/CVE-2025-57389

View Code ZIP pw:eip

References (2)

[Various Sources] https://github.com/openwrt/luci/blob/20b3600d4d64bf60588cf4975c7a62104411870e/modules/luci-mod-admin-full/luasrc/view/admin_system/packages.htm#L73

[Various Sources] https://github.com/amalcew/CVE-2025-57389

Scores

CVSS v3 5.4

EPSS 0.0003

EPSS Percentile 7.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Published Oct 01, 2025

Tracked Since Feb 18, 2026