Luci
Vendor:
First CVE: May 23, 2019 · Active for 7 years
9
Total CVEs
More Total CVEs than 86% of tracked products
1.5
Avg CVEs / Year
Higher CVE frequency than 56% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 42% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Luci over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 23, 2019
7 years ago
Most Recent CVE
Jul 12, 2026
12 days ago
CVE Severity & Scoring
Luci9 CVEs
56%
33%
11%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network6 (66.7%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network3 (33.3%)
Attack Complexity
Low9 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None3 (33.3%)
Unknown0 (0.0%)
Required6 (66.7%)
Privileges Required
Low4 (44.4%)
High0 (0.0%)
None5 (55.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-61876HIGH LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCP | Jul 12, 2026 | 8.8 | 40 | NO | NO |
CVE-2026-59260HIGH OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users to execute the Samba daemon with caller-controlled command-li | Jul 12, 2026 | 8.8 | 40 | NO | NO |
CVE-2026-61875HIGH luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers | Jul 12, 2026 | 8.8 | 39 | NO | NO |
CVE-2019-12272CRITICAL In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command inject | May 23, 2019 | 9.8 | 33 | NO | NO |
CVE-2021-27821MEDIUM The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting vulnerability. | May 25, 2021 | 6.1 | 22 | NO | NO |
CVE-2026-32721MEDIUM LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan | Mar 19, 2026 | 4.8 | 21 | NO | NO |
CVE-2022-41435MEDIUM OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js. This vulnerability al | Nov 3, 2022 | 5.4 | 21 | NO | NO |
CVE-2023-24181MEDIUM LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /openvpn/pageswitch.htm. | Apr 10, 2023 | 5.4 | 19 | NO | NO |
CVE-2020-10871MEDIUM In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report becau | Mar 23, 2020 | 5.3 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For Luci
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| git-22.140.66206-02913be | 1 | 5.4 | 0.5% | 0 | 0 |
| git-20.078.22902-0ed0d42 | 1 | 5.3 | 1.7% | 0 | 0 |
| git-20.049.11521-bebfe20 | 1 | 5.3 | 1.7% | 0 | 0 |
| 22.03.3 | 1 | 5.4 | 0.6% | 0 | 0 |