- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://openwrt.org
Products and areas 12
- libubox and its blob and JSON parsing, which almost every OpenWrt component links and feeds untrusted data into
- LuCI in full: the web interface, its CGI and RPC endpoints, session handling, the ACL system that decides which RPC methods a session may call, and every luci-app and luci-proto module in the tree
- netifd and the network configuration layer, including the protocol handler scripts that build interfaces out of configuration
- Package handling through opkg and apk, signature verification, and the update path that installs code onto the device
- procd, the init and process manager, along with the service definitions and hotplug handling it executes
- rpcd and its plugins, the RPC daemon that LuCI and remote management tooling call into
- The image build system and the sysupgrade path, which decide what firmware the device runs after a reboot
- The network daemons as packaged and configured by OpenWrt, including dnsmasq and odhcpd, plus firewall and nftables rule generation
- The security guide states that reports cover the OpenWrt distribution with the official package feeds hosted at github.com/openwrt, and also the OpenWrt-specific tools hosted at git.openwrt.org such as procd, ubus and libubox. That is the declared boundary, and everything below sits inside it
- The UCI configuration system and everything that reads or writes it
- ubus and ubusd, the message bus every daemon on the system speaks through, together with the ACL files governing who may call what
- uhttpd, the web server LuCI runs on, and its CGI and Lua handlers
Out of scope (6)
- Configuration decisions an administrator made, such as exposing LuCI on the WAN interface or leaving a default password in place
- Denial of service that amounts to saturating the device's links
- OEM and ODM vendor forks. A defect that exists only in a vendor's derivative belongs to that vendor, and those forks routinely lag upstream by years
- Physical attacks on a router an attacker already holds, including serial console access and flash readout
- Third-party packages outside the official feeds the policy names
- Upstream defects in packaged software that OpenWrt ships unmodified, unless the OpenWrt packaging or default configuration is what makes them reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report in confidence to the address on the policy page , the address the security guide names, or through GitHub private vulnerability reporting, which is enabled on openwrt/openwrt and openwrt/luci
-
The standalone openwrt/ubus repository has no security policy of its own and private reporting is disabled there. The OpenWrt policy covers it, so file through the main channel rather than treating it as unreachable
-
Name the release branch and the target architecture, and say whether the defect sits in core, in LuCI or in a package feed
-
State the privilege you started from. LuCI runs privileged, so the difference between an unauthenticated finding and one needing a session is the whole severity question here
Not accepted
-
OEM and ODM vendor forks
-
Third-party packages outside the official feeds the policy names
-
Configuration decisions an administrator made, such as exposing LuCI on the WAN interface or leaving a default password in place
-
Upstream defects in packaged software that OpenWrt ships unmodified, unless the OpenWrt packaging or default configuration is what makes them reachable
-
Physical attacks on a router an attacker already holds, including serial console access and flash readout
-
Denial of service that amounts to saturating the device's links
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-62947 | OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch() without FNM_PATHNAME, allowing traversal such as an allowed wildcard prefix followed by ../ to read root-readable files including /etc/shadow. This vul | Medium 4.9 | 15 Jul 2026 |
| CVE-2026-62948 | OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/sta | Critical 9.6 | 15 Jul 2026 |
| CVE-2026-55490 | OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflow in handle_send_a() of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The message length underflows before a bounds check and is then passed to memcpy as a very large size. This issue is fixed v25.12.5 | Medium 6.5 | 7 Jul 2026 |
| CVE-2026-30874 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6, a vulnerability in the hotplug_call function allows an attacker to bypass environment variable filtering and inject an arbitrary PATH variable, potentially leading to privilege escalation. The function is intended to filter out sensitive environment variables like PATH when executing hotplug scrip | Low 1.8 | 19 Mar 2026 |
| CVE-2026-32721 | LuCI is the OpenWrt Configuration Interface. Versions prior to both 24.10.5 and 25.12.0, contain a stored XSS vulnerability in the wireless scan modal, where SSID values from scan results are rendered as raw HTML without any sanitization. The wireless.js file in the luci-mod-network package passes SSIDs via a template literal to dom.append(), which processes them through innerHTML, allowing an att | High 8.6 | 19 Mar 2026 |
| CVE-2026-30871 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the parse_question function. The issue is triggered by PTR queries for reverse DNS domains (.in-addr.arpa and .ip6.arpa). DNS packets received on UDP port 5353 are expanded by dn_expand into an 8096-byte global buffer ( | Critical 9.5 | 19 Mar 2026 |
| CVE-2026-30872 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based Buffer Overflow vulnerability in the match_ipv6_addresses function, triggered when processing PTR queries for IPv6 reverse DNS domains (.ip6.arpa) received via multicast DNS on UDP port 5353. During processing, the domain name from name_buffer is copie | Critical 9.5 | 19 Mar 2026 |
| CVE-2026-30873 | OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to both 24.10.6 and 25.12.1, the jp_get_token function, which performs lexical analysis by breaking input expressions into tokens, contains a memory leak vulnerability when extracting string literals, field labels, and regular expressions using dynamic memory allocation. These extracted results are stored in | Low 2.4 | 19 Mar 2026 |
| CVE-2026-20435 | In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118. | Medium 4.6 | 2 Mar 2026 |
| CVE-2026-20430 | In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00467553; Issue ID: MSV-5151. | High 8.8 | 2 Mar 2026 |
| CVE-2026-20419 | In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461663 / WCNCR00463309; Issue ID: MSV-4852. | Medium 6.5 | 2 Feb 2026 |
| CVE-2026-20408 | In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758. | High 8.8 | 2 Feb 2026 |
| CVE-2025-20765 | In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10190802; Issue ID: MSV-4833. | Medium 4.7 | 2 Dec 2025 |
| CVE-2025-20747 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-20748 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432679; Issue ID: MSV-3950. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-20746 | In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-20742 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00432680; Issue ID: MSV-3949. | High 8.0 | 4 Nov 2025 |
| CVE-2025-20741 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00434422; Issue ID: MSV-3958. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-20739 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435340; Issue ID: MSV-4038. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-20737 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435343; Issue ID: MSV-4040. | High 7.8 | 4 Nov 2025 |
| CVE-2025-20738 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435342; Issue ID: MSV-4039. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-20736 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00435347; Issue ID: MSV-4049. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-20735 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00435349; Issue ID: MSV-4051. | High 7.8 | 4 Nov 2025 |
| CVE-2025-20733 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00441509; Issue ID: MSV-4138. | High 7.8 | 4 Nov 2025 |
| CVE-2025-20734 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00441507; Issue ID: MSV-4112. | Medium 5.3 | 4 Nov 2025 |
| CVE-2025-20732 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID: WCNCR00441510; Issue ID: MSV-4139. | Medium 5.3 | 4 Nov 2025 |
| CVE-2025-20731 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege (when OceReducedNeighborReport is disabled). User interaction is not needed for exploitation. Patch ID: WCNCR00441511; Issue ID: MSV-4140. | Medium 5.3 | 4 Nov 2025 |
| CVE-2025-20729 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00441512; Issue ID: MSV-4153. | Medium 4.2 | 4 Nov 2025 |
| CVE-2025-20730 | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10068463; Issue ID: MSV-4141. | Medium 6.7 | 4 Nov 2025 |
| CVE-2025-62525 | OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for th | High 7.9 | 22 Oct 2025 |
| CVE-2025-62526 | OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, ubusd contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon. The affected code is executed before running the ACL checks, all ubus clients are able to send such message | High 7.9 | 22 Oct 2025 |
| CVE-2025-20718 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00419945; Issue ID: MSV-3581. | High 7.8 | 14 Oct 2025 |
| CVE-2025-20719 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418955; Issue ID: MSV-3570. | High 8.8 | 14 Oct 2025 |
| CVE-2025-20720 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418954; Issue ID: MSV-3569. | High 8.8 | 14 Oct 2025 |
| CVE-2025-20722 | In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798. | Medium 5.5 | 14 Oct 2025 |
| CVE-2025-20724 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418894; Issue ID: MSV-3475. | Medium 5.5 | 14 Oct 2025 |
| CVE-2025-20711 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422399; Issue ID: MSV-3748. | High 8.8 | 14 Oct 2025 |
| CVE-2025-20712 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00422323; Issue ID: MSV-3810. | High 8.8 | 14 Oct 2025 |
| CVE-2025-20713 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432661; Issue ID: MSV-3904. | High 7.8 | 14 Oct 2025 |
| CVE-2025-20714 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00432659; Issue ID: MSV-3902. | High 7.8 | 14 Oct 2025 |
| CVE-2025-20715 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00421152; Issue ID: MSV-3731. | High 7.8 | 14 Oct 2025 |
| CVE-2025-20716 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00421149; Issue ID: MSV-3728. | High 7.8 | 14 Oct 2025 |
| CVE-2025-20717 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: WCNCR00419946; Issue ID: MSV-3582. | High 7.8 | 14 Oct 2025 |
| CVE-2025-20709 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415809; Issue ID: MSV-3405. | High 8.8 | 14 Oct 2025 |
| CVE-2025-20710 | In wlan AP driver, there is a possible out of bounds write due to an integer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418785; Issue ID: MSV-3515. | High 8.8 | 14 Oct 2025 |
| CVE-2025-20705 | In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09989078; Issue ID: MSV-3964. | High 7.8 | 1 Sep 2025 |
| CVE-2025-20696 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS09915215; Issue ID: MSV-3801. | Medium 6.8 | 4 Aug 2025 |
| CVE-2025-20689 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418048; Issue ID: MSV-3479. | Medium 5.5 | 8 Jul 2025 |
| CVE-2025-20690 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418038; Issue ID: MSV-3478. | Medium 5.5 | 8 Jul 2025 |
| CVE-2025-20691 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418039; Issue ID: MSV-3477. | Medium 5.5 | 8 Jul 2025 |
| CVE-2025-20692 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418040; Issue ID: MSV-3476. | Medium 5.5 | 8 Jul 2025 |
| CVE-2025-20693 | In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09812521; Issue ID: MSV-3421. | Medium 6.5 | 8 Jul 2025 |
| CVE-2025-20694 | In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09752821; Issue ID: MSV-3342. | Medium 6.5 | 8 Jul 2025 |
| CVE-2025-20695 | In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09741871; Issue ID: MSV-3317. | Medium 6.5 | 8 Jul 2025 |
| CVE-2025-20683 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416938; Issue ID: MSV-3444. | Critical 9.8 | 8 Jul 2025 |
| CVE-2025-20685 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416226; Issue ID: MSV-3409. | High 8.8 | 8 Jul 2025 |
| CVE-2025-20686 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00415570; Issue ID: MSV-3404. | High 8.8 | 8 Jul 2025 |
| CVE-2025-20688 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00418047; Issue ID: MSV-3480. | Medium 5.5 | 8 Jul 2025 |
| CVE-2025-20681 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416936; Issue ID: MSV-3446. | Critical 9.8 | 8 Jul 2025 |
| CVE-2025-20682 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416937; Issue ID: MSV-3445. | Critical 9.8 | 8 Jul 2025 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 27 Last 12 months Injection 35 % Memory safety 28 % Access control 22 % Privilege escalation 15 % Latest advisories Loading the feed Overview OpenWrt is the Linux distribution that consumer and prosumer router firmware is built on, and a long tail of OEM and ODM vendor SDKs are forks of it that never rebase. The device it runs on is the edge of the network by definition, with a WAN interface facing the internet and the LuCI web interface facing every host on the LAN. CVE-2025-62526 is the reference point: a heap buffer overflow in ubusd, the message bus every service on the box talks through. The project asks for security reports in confidence to a project address and pays nothing for them, so sorona.xyz pays you directly on qualified, reproduced findings. In scope The security guide states that reports cover the OpenWrt distribution with the official package feeds hosted at github.com/openwrt, and also the OpenWrt-specific tools hosted at git.openwrt.org such as procd, ubus and libubox. That is the declared boundary, and everything below sits inside it LuCI in full: the web interface, its CGI and RPC endpoints, session handling, the ACL system that decides which RPC methods a session may call, and every luci-app and luci-proto module in the tree uhttpd, the web server LuCI runs on, and its CGI and Lua handlers ubus and ubusd, the message bus every daemon on the system speaks through, together with the ACL files governing who may call what libubox and its blob and JSON parsing, which almost every OpenWrt component links and feeds untrusted data into procd, the init and process manager, along with the service definitions and hotplug handling it executes netifd and the network configuration layer, including the protocol handler scripts that build interfaces out of configuration rpcd and its plugins, the RPC daemon that LuCI and remote management tooling call into The UCI configuration system and everything that reads or writes it Package handling through opkg and apk, signature verification, and the update path that installs code onto the device The network daemons as packaged and configured by OpenWrt, including dnsmasq and odhcpd, plus firewall and nftables rule generation The image build system and the sysupgrade path, which decide what firmware the device runs after a reboot Out of scope OEM and ODM vendor forks. A defect that exists only in a vendor's derivative belongs to that vendor, and those forks routinely lag upstream by years Third-party packages outside the official feeds the policy names Configuration decisions an administrator made, such as exposing LuCI on the WAN interface or leaving a default password in place Upstream defects in packaged software that OpenWrt ships unmodified, unless the OpenWrt packaging or default configuration is what makes them reachable Physical attacks on a router an attacker already holds, including serial console access and flash readout Denial of service that amounts to saturating the device's links Most-valued findings Command injection reachable from LuCI, the densest class in the current record. The luci-proto-openvpn key generation defect ran attacker-supplied input as root, and the web interface is privileged by design ACL flaws in ubus or rpcd where a low-privilege session reaches a method it should not, including the recent case where a stale ACL granted write access to root's crontab Memory corruption in ubusd or libubox, the shape CVE-2025-62526 took. Every service on the box speaks through that bus, so a parsing bug there is reachable from many directions at once Anything reachable from the WAN interface without credentials, since that is the surface the entire internet can touch Authentication bypass on LuCI or rpcd, which amounts to full administrative control of the network's edge device Stored cross-site scripting in luci-app modules, a recurring class in the recent batch, since a LuCI session is a root-equivalent session Local privilege escalation in kernel modules and drivers shipped by the project, the class CVE-2025-62525 landed in with ltq-ptm Defects in package signature verification or the sysupgrade path, which put attacker-chosen firmware onto the device permanently Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report in confidence to [email protected] , the address the security guide names, or through GitHub private vulnerability reporting, which is enabled on openwrt/openwrt and openwrt/luci The project says in its own guide that the contact mailbox is not always monitored and mail there may go unnoticed. Its documented fallback is to ping the public openwrt-adm list with no detail at all and wait to be contacted privately The declared scope covers the OpenWrt distribution with the official package feeds on github.com/openwrt, plus the OpenWrt-specific tools on git.openwrt.org including procd, ubus and libubox The standalone openwrt/ubus repository has no security policy of its own and private reporting is disabled there. The OpenWrt policy covers it, so file through the main channel rather than treating it as unreachable Name the release branch and the target architecture, and say whether the defect sits in core, in LuCI or in a package feed State the privilege you started from. LuCI runs privileged, so the difference between an unauthenticated finding and one needing a session is the whole severity question here No money language appears on the security guide or the advisory index and the project is on no bounty platform, so there is no payment to negotiate upstream Disclosure Coordinated privately with the OpenWrt developers, published as a GitHub Security Advisory on the affected repository and carried in the project's advisory index. Volume is high and recent: nine core advisories and eighteen LuCI advisories inside the last twelve months. A fix landing upstream is only the beginning, since vendor forks routinely take years to converge or never do at all, so expect the field exposure to outlive the embargo by a long way. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability