CVE-2021-33425

5.4 mediumEPSS 0.5%

Medium (5.4) in openwrt openwrt. EPSS 0.5% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability was discovered in the Web Interface for OpenWRT LuCI version 19.07 which allows attackers to inject arbitrary Javascript in the OpenWRT Hostname via the Hostname Change operation.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-05-25
Modified: 2026-07-09
Record from: the NVD, synced 2026-10-19

Affected

openwrt:openwrt

References

http://www.openwall.com/lists/oss-security/2021/11/09/1
http://www.openwall.com/lists/oss-security/2021/11/09/1

Check your stack JSON