The vulnerability in OpenWrt's luci-app-https-dns-proxy involves improper neutralization of input during web page generation, specifically in the resolver_url parameter. Authenticated users can store malicious HTML/JavaScript payloads that execute when an administrator accesses the status page, resulting in cross-site scripting. The CVSS 4.0 vector indicates the attack requires adjacent network access, low attack complexity, no user interaction, and high impact on confidentiality via the browser context. No official remediation or patch information is currently available.

Successful exploitation allows an authenticated user to execute arbitrary JavaScript in the administrator's browser when viewing the HTTPS DNS Proxy status page. This could lead to unauthorized actions performed with administrator privileges within the web interface context, potentially compromising confidentiality or integrity of the management session. However, exploitation requires authentication and adjacent network access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the luci interface to trusted administrators only and avoid viewing the HTTPS DNS Proxy status page with untrusted input. Monitor official OpenWrt channels for updates and apply patches promptly once released.