CVE-2026-61875 is a stored cross-site scripting vulnerability in the luci-app-upnp component of OpenWrt's luci interface. It allows unauthenticated attackers on the LAN to inject JavaScript code through the NewPortMappingDescription field in UPnP IGD AddPortMapping SOAP requests. The miniupnpd service stores this malicious input, and luci-app-upnp renders it without output encoding on the UPnP or Status pages. This results in script execution in the context of the administrator's browser when these pages are viewed, potentially leading to session hijacking or other malicious actions. The vulnerability is exploitable remotely within the LAN without authentication.

Successful exploitation allows unauthenticated LAN attackers to execute arbitrary JavaScript code in the context of the administrator's browser when viewing the affected luci-app-upnp pages. This can lead to session hijacking, unauthorized actions within the administrative interface, or other attacks leveraging the administrator's privileges. The vulnerability affects the confidentiality and integrity of the administrative session. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict LAN access to trusted users and avoid viewing the UPnP or Status pages in luci-app-upnp if possible. Monitor vendor communications for updates and apply patches promptly once released.