Loading story…
OpenWrt released v25.12.5 with urgent fixes for multiple security issues in default-enabled network services, including CVE-2026-62948, a flaw that lets an unauthenticated DHCPv6 client inject forged lines into /tmp/odhcpd.leases through the FQDN hostname option. Those injected entries can later be rendered as live HTML in the LuCI “Active DHCPv6 Leases” page, creating a stored cross-site scripting path against administrators who view the interface. The vulnerability affects OpenWrt versions prior to 25.12.5 and carries a high-impact CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H rating.
The service release also patches additional vulnerabilities across odhcpd, uhttpd, LuCI, cgi-io, and ead, alongside updates to the Linux kernel, OpenSSL, musl libc, and dropbear. OpenWrt said several of the corrected issues could enable remote code execution, request smuggling, stored XSS, privilege escalation, arbitrary file read, memory corruption, or denial of service, and strongly urged users to upgrade. Advisory metadata for CVE-2026-62948 indicates proof-of-concept exploitation exists, although exploitation is not considered automatable.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE entry documented CVE-2026-62948, an OpenWrt vulnerability affecting versions prior to 25.12.5 in which an unauthenticated DHCPv6 client can inject forged lease-file lines via the FQDN hostname field. Those entries can later be rendered as live HTML in the LuCI Active DHCPv6 Leases admin page, creating a stored XSS-style attack path.
OpenWrt announced version 25.12.5 as the fifth service release in the 25.12 stable series, including fixes for multiple remotely triggerable vulnerabilities in default-enabled network services. The release specifically remediated flaws across odhcpd, LuCI, uhttpd, cgi-io, and other components, and OpenWrt recommended users upgrade.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT/CC and the dnsmasq maintainer disclosed six vulnerabilities in **dnsmasq** that affect most supported, non-legacy versions and can lead to DNS cache poisoning, denial of service, information disclosure, security-control bypass, heap manipulation, and local privilege escalation. The issues are tracked as `CVE-2026-2291`, `CVE-2026-4890`, `CVE-2026-4891`, `CVE-2026-4892`, `CVE-2026-4893`, and `CVE-2026-5172`, and stem from flaws in memory safety, input validation, DNSSEC handling, DHCPv6, and DNS parsing. Several attack paths are remote via crafted DNS packets or malformed DNS responses, while `CVE-2026-4892` is a heap-based out-of-bounds write in DHCPv6 that can let a local attacker execute arbitrary code as root with a crafted packet. Maintainer Simon Kelley released **dnsmasq `2.92rel2`** with backported fixes for the stable branch and indicated the fixes are incorporated into **version `2.93`**, which CERT/CC lists as fixed. Vendor remediation followed quickly, including a Debian security update (`DSA 6264-1`), and additional vendors were expected to publish patched packages. The disclosure drew attention because dnsmasq is widely deployed in routers, Linux systems, and embedded environments, making prompt patching important wherever the service is exposed to untrusted DNS or local network traffic.
Jul 20, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026
Pi-hole disclosed two high-severity remote code execution vulnerabilities in its FTLDNS component, tracked as **CVE-2026-35518** and **CVE-2026-35520**, affecting `pihole-FTL` versions **6.0 through before 6.6**. The flaws let an authenticated attacker inject arbitrary `dnsmasq` configuration directives through newline characters in the `dns.cnameRecords` and `dhcp.leaseTime` configuration parameters, which can result in command execution on the underlying system. Both issues carry a **CVSS v3.1** score vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, indicating low-complexity network exploitation with high impact to confidentiality, integrity, and availability once authenticated access is obtained. The vulnerabilities are mapped to **CWE-78** and **CWE-93**, and Pi-hole fixed both in **version 6.6**; one related advisory is published as **GHSA-28g5-gg88-wh5m**.
Jun 29, 2026