Critical OpenWrt DHCPv6 Flaw Allows Unauthenticated Root Code Execution
A critical stack overflow vulnerability in OpenWrt's DHCPv6 service, CVE-2026-53921, allows unauthenticated attackers to achieve remote code execution with root privileges.
OpenWrt has released version 24.10.8 to address CVE-2026-53921, a critical vulnerability rated 9.8 on the CVSS 3.1 scale. This flaw resides within the DHCPv6 stack and can be exploited by unauthenticated attackers who can reach the DHCPv6 server. By sending a specially crafted DHCPv6 REQUEST message, attackers can overwrite a stack buffer in the odhcpd service, potentially leading to the execution of arbitrary code with root privileges on affected devices.
The odhcpd service typically runs with root privileges. The advisory highlights that many embedded hardware devices lack crucial security features like stack canaries and address space layout randomization (ASLR), making successful code execution a realistic outcome for attackers. The vulnerability stems from two distinct overflow sites within the DHCPv6 request-processing path. In both instances, crafted options within the DHCPv6 message leave insufficient space in a fixed 512-byte stack buffer before appending additional reply data without adequate bounds checking.
The advisory details that the first overflow path can be triggered by creating five IA_NA bindings with an earlier SOLICIT message, followed by a crafted DHCPv6 REQUEST. The second path is triggered by a single crafted REQUEST message. The affected versions of odhcpd include all versions prior to commit e432dd6 in the master branch, specifically those containing the dhcpv6_ia_handle_IAs() and build_ia() functions. OpenWrt has provided fixes in versions 24.10.8 and 25.12.5.
While proof-of-concept code has been made public, OpenWrt's advisory did not report any instances of exploitation in the wild as of July 28, 2026. The vulnerability has also not yet been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. However, the absence from KEV does not definitively confirm that no exploitation has occurred.
In addition to the critical CVE-2026-53921, the 24.10.8 release also patches several other pre-authentication vulnerabilities within odhcpd. These include an out-of-bounds write, a use-after-free condition, memory disclosure, denial of service, a stack over-read, and issues related to neighbor discovery proxy spoofing. The release also addresses three HTTP request smuggling bugs in the uhttpd service and a DHCPv6 hostname injection flaw (CVE-2026-62948) that can lead to stored cross-site scripting (XSS) when an administrator views the LuCI leases page.
Furthermore, the same release includes CVE-2026-62947 in cgi-io, which allows for path traversal, potentially exposing arbitrary root-readable files. This specific vulnerability requires an authenticated session with the cgi-io download permission and an applicable wildcard file-read grant, making it less of an anonymous threat compared to the DHCPv6 flaw.
Separately, an AI-assisted audit conducted by Hacker House identified additional vulnerabilities in optional LuCI components, including command injection, path traversal, and cross-site scripting (XSS) weaknesses. OpenWrt also discovered a stored XSS issue and missing CSRF protection while preparing these fixes. These additional LuCI-related fixes were still under review and not included in the 24.10.8 release as of July 28, 2026.
OpenWrt 24.10 is currently under security maintenance, with its end-of-life projected for September 2026. The project strongly recommends that users migrate to the 25.12 series before this date to ensure continued security support. Users should also be aware that packages installed separately from the main firmware image may require their own independent updates.