openwrt luci
productUScpe:2.3:a:openwrt:luci:*:*:*:*:*:*:*:*
A product tracked in the threat graph; the vulnerabilities below are known to affect it.
0
KEV-listed
0
EPSS ≥ 10%
by severity
1critical0high5medium0low
updated 2026-10-30
01
vulnerabilities (6)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2019-12272US | critical9.8 | Exploit | ||||
In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command inject… | ||||||
| CVE-2020-10871US | medium5.3 | — | ||||
In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report becau… | ||||||
| CVE-2023-24181US | medium5.4 | — | ||||
LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm. | ||||||
| CVE-2021-27821US | medium6.1 | — | ||||
The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability. | ||||||
| CVE-2022-41435US | medium5.4 | — | ||||
OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability al… | ||||||
| CVE-2026-32721US | medium4.8 | — | ||||
LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan… | ||||||
02
weaknesses (3)
The flaw types (CWEs) most of these CVEs share.
03
sources (1)
Which sources assert this record, and when.
- USNVD / CVE6 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan