This vulnerability involves a rather unconventional vector for XSS - the comment field of an SSH public key. Since patched in newer versions of LuCI, which ensure to not display public key comments verbatim in order to prevent injection of any markup, including <script> tags.