CVE-2021-28961: Openwrt

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.

Affected products

• Openwrt Openwrt: version 19.07.0 only

Published 2021-03-21. Last modified 2026-06-17.