OpenWrt has released version 24.10.8 to address a critical vulnerability in its DHCPv6 server, odhcpd, which could allow unauthenticated attackers to execute arbitrary code with root privileges. This flaw, identified as CVE-2026-53921, has been assigned a CVSS score of 9.8, indicating its severity.
The vulnerability resides in the handling of DHCPv6 REQUEST packets. Specifically, crafted packets can trigger a stack buffer overflow in odhcpd, leading to potential code execution. Given that odhcpd operates with root privileges, successful exploitation could grant attackers full control over the affected device. The risk is heightened on embedded hardware lacking security features like stack canaries and Address Space Layout Randomization (ASLR), making exploitation more feasible.
OpenWrt’s advisory provides public Python proof-of-concept code demonstrating the exploitability of this flaw. Users are strongly advised to upgrade to version 24.10.8 or 25.12.5, depending on their current branch, to mitigate this risk. Firmware updates are available through the OpenWrt Firmware Selector.
In addition to CVE-2026-53921, the latest release addresses several other vulnerabilities in default-enabled network services. These include an out-of-bounds write, use-after-free, memory disclosure, denial of service, stack over-read, and neighbor-discovery proxy spoofing in odhcpd. Furthermore, three HTTP request-smuggling issues in uhttpd and a DHCPv6 hostname-injection flaw (CVE-2026-62948) that can lead to stored cross-site scripting (XSS) attacks have been patched.
As of July 28, 2026, there have been no reported instances of this vulnerability being exploited in the wild. However, the availability of proof-of-concept code underscores the urgency for users to update their systems promptly.
OpenWrt’s proactive approach in identifying and patching these vulnerabilities highlights the importance of regular software updates in maintaining network security. Users should remain vigilant and ensure their devices are running the latest firmware versions to protect against potential threats.
