OpenWrt Security Advisories

  1. Security Advisory 2025-12-16-1 - Dropbear privilege escalation via Unix domain socket forwarding (CVE-2025-14282)
  2. Security Advisory 2025-10-22-2 - ltq-ptm: local privilege escalation (CVE-2025-62525)
  3. Security Advisory 2025-10-22-1 - ubusd: heap buffer overflow (CVE-2025-62526)
  4. Security Advisory 2024-12-06-1 - OpenWrt Attended SysUpgrade server: Build artifact poisoning via truncated SHA-256 hash and command injection (CVE-2024-54143)
  5. Security Advisory 2022-10-17-1 - Multiple issues in mac80211 and cfg80211 (CVE-2022-41674, CVE-2022-42719, CVE-2022-42720, CVE-2022-42721 and CVE-2022-42722)
  6. Security Advisory 2022-10-04-1 - wolfSSL buffer overflow during a TLS 1.3 handshake (CVE-2022-39173)
  7. Security Advisory 2021-08-01-3 - luci-app-ddns: Multiple authenticated RCEs (CVE-2021-28961)
  8. Security Advisory 2021-08-01-2 - Stored XSS in hostname UCI variable (CVE-2021-33425)
  9. Security Advisory 2021-08-01-1 - XSS via missing input validation of host names displayed (CVE-2021-32019)
  10. Security Advisory 2021-02-02-2 - wolfSSL heap buffer overflow in RsaPad_PSS (CVE-2020-36177)
  11. Security Advisory 2021-02-02-1 - netifd and odhcp6c routing loop on IPv6 point to point links (CVE-2021-22161)
  12. Security Advisory 2021-01-19-1 - dnsmasq multiple vulnerabilities (CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25684, CVE-2020-25685, CVE-2020-25686, CVE-2020-25687)
  13. Security Advisory 2021-01-17-1 - OpenWrt forum break-in on 16-Jan-2021
  14. Security Advisory 2020-12-09-2 - libuci import heap use after free (CVE-2020-28951)
  15. Security Advisory 2020-12-09-1 - Linux kernel - ICMP rate limiting can be used to facilitate DNS poisoning attack (CVE-2020-25705)
  16. Security Advisory 2020-05-06-2 - relayd out-of-bounds reads of heap data and possible buffer overflow (CVE-2020-11752)
  17. Security Advisory 2020-05-06-1 - umdns out-of-bounds reads of heap data and possible buffer overflow (CVE-2020-11750)
  18. Security Advisory 2020-02-21-1 - ppp buffer overflow vulnerability (CVE-2020-8597)
  19. Security Advisory 2020-01-31-2 - libubox tagged binary data JSON serialization vulnerability (CVE-2020-7248)
  20. Security Advisory 2020-01-31-1 - Opkg susceptible to MITM (CVE-2020-7982)
  21. Security Advisory 2020-01-13-1 - uhttpd invalid data access via HTTP POST request (CVE-2019-19945)
  22. Security Advisory 2019-11-05-3 - ustream-ssl information disclosure (CVE-2019-5101, CVE-2019-5102)
  23. Security Advisory 2019-11-05-2 - LuCI CSRF vulnerability (CVE-2019-17367)
  24. Security Advisory 2019-11-05-1 - LuCI stored XSS