PatchTheCVEluci vulnerabilities and fixes
Recent CVEs affecting luci, with upgrade or downgrade steps. 10 tracked.
luci has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-03-19. Highest priority: CVE-2019-12272 (score 63/100).
- CVE-2021-27821 MEDIUM 6.1 UPGRADE The Web Interface for OpenWRT LuCI version 19.07 and lower has been discovered to have a cross-site scripting
- CVE-2026-32721 HIGH 8.6 UPGRADE UPGRADE LuCI is the OpenWrt Configuration Interface
- CVE-2023-3085 LOW 3.5 UPGRADE A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504
- CVE-2023-24181 MEDIUM 5.4 DOWNGRADE LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting
- CVE-2022-41435 MEDIUM 5.4 DOWNGRADE OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vu
- CVE-2020-10871 MEDIUM 5.3 DOWNGRADE In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and ser
- CVE-2019-12272 CRITICAL 9.8 UPGRADE In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/w
- CVE-2014-3593 MEDIUM 6.0 DOWNGRADE Eval injection vulnerability in luci 0.26.0 allows remote authenticated users with certain permissions to exec
- CVE-2013-4482 MEDIUM 6.2 DOWNGRADE MITIGATE Untrusted search path vulnerability in python-paste-script (aka paster) in Luci 0.26.0, when started using the
- CVE-2013-4481 LOW 1.9 DOWNGRADE MITIGATE Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restri
FAQ
How do I fix luci vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is luci being exploited right now?
None of the tracked luci CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which luci CVE should I patch first?
CVE-2019-12272 currently ranks highest (63/100): In OpenWrt LuCI through 0.10, the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/w.