Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

OpenWrt bug bounty programs

openwrt.org Updated

OpenWrt runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program OpenWrt runs.

  • OpenWrt

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://openwrt.org

    Web

  • libubox and its blob and JSON parsing, which almost every OpenWrt component links and feeds untrusted data into

    Products and areas

  • LuCI in full: the web interface, its CGI and RPC endpoints, session handling, the ACL system that decides which RPC methods a session may call, and every luci-app and luci-proto module in the tree

    Products and areas

  • netifd and the network configuration layer, including the protocol handler scripts that build interfaces out of configuration

    Products and areas

  • Package handling through opkg and apk, signature verification, and the update path that installs code onto the device

    Products and areas

  • procd, the init and process manager, along with the service definitions and hotplug handling it executes

    Products and areas

  • rpcd and its plugins, the RPC daemon that LuCI and remote management tooling call into

    Products and areas

  • The image build system and the sysupgrade path, which decide what firmware the device runs after a reboot

    Products and areas

  • The network daemons as packaged and configured by OpenWrt, including dnsmasq and odhcpd, plus firewall and nftables rule generation

    Products and areas

  • The security guide states that reports cover the OpenWrt distribution with the official package feeds hosted at github.com/openwrt, and also the OpenWrt-specific tools hosted at git.openwrt.org such as procd, ubus and libubox. That is the declared boundary, and everything below sits inside it

    Products and areas

  • The UCI configuration system and everything that reads or writes it

    Products and areas

  • ubus and ubusd, the message bus every daemon on the system speaks through, together with the ACL files governing who may call what

    Products and areas

  • uhttpd, the web server LuCI runs on, and its CGI and Lua handlers

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Configuration decisions an administrator made, such as exposing LuCI on the WAN interface or leaving a default password in place

  • Denial of service that amounts to saturating the device's links

  • OEM and ODM vendor forks. A defect that exists only in a vendor's derivative belongs to that vendor, and those forks routinely lag upstream by years

  • Physical attacks on a router an attacker already holds, including serial console access and flash readout

  • Third-party packages outside the official feeds the policy names

  • Upstream defects in packaged software that OpenWrt ships unmodified, unless the OpenWrt packaging or default configuration is what makes them reachable

Recent changes

Reward and scope changes across every OpenWrt program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in OpenWrt products, from the NVD.

Search NVD
  • CVE-2026-62947 Medium

    OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vul

  • CVE-2026-62948 Critical

    OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta

  • CVE-2026-55490 Medium

    OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5

  • CVE-2026-30874 Low

    OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scrip

  • CVE-2026-32721 High

    LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an att

  • CVE-2026-30871 Critical

    OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dn_expand into an 8096-byte global buffer (

  • CVE-2026-30872 Critical

    OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. During processing, the domain name from name_buffer is copie

  • CVE-2026-30873 Low

    OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in

About this page

This page gathers every public program listed under openwrt.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.