CVE-2026-61875 is a stored cross-site scripting vulnerability in OpenWrt's luci-app-upnp. It allows unauthenticated attackers on the LAN to inject JavaScript code through the NewPortMappingDescription field in UPnP IGD AddPortMapping SOAP requests. The miniupnpd service stores this input, and luci-app-upnp renders it without output encoding, causing the malicious script to execute in the context of the administrator's browser when viewing UPnP or Status pages. This vulnerability can be exploited without authentication and requires no user interaction beyond viewing the affected pages.

Successful exploitation results in arbitrary JavaScript execution in the administrator's browser context, potentially leading to session hijacking, unauthorized actions, or further compromise of the device management interface. The vulnerability affects unauthenticated LAN clients, increasing the risk within local network environments. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict LAN access to trusted users and consider disabling UPnP if not required. Administrators should be cautious when viewing UPnP or Status pages and monitor for updates from OpenWrt regarding patches or official fixes.