OpenWrt DHCPv6 hostname injection enables stored XSS in LuCI admin UI
A stack‑overflow‑free bug in odhcpd writes an attacker‑controlled DHCPv6 hostname directly to /tmp/odhcpd.leases without escaping. LuCI reads this file and injects the hostname into the admin page without HTML‑escaping, creating a stored XSS that can grant root‑level code execution on default‑config OpenWrt devices. Updating to OpenWrt 24.10.8 or later patches the flaw.