OpenWrt Patches Critical DHCPv6 Flaw Allowing Remote Code Execution as Root

Critical Vulnerability Addressed

OpenWrt has issued updates, versions 24.10.8 and 25.12.5, to resolve a critical DHCPv6 stack overflow vulnerability, identified as CVE-2026-53921. This flaw, rated 9.8 on CVSS 3.1, allows an unauthenticated attacker to overwrite a stack buffer in the odhcpd service through a specially crafted DHCPv6 REQUEST.

The odhcpd service operates with root privileges, and the advisory highlights that many embedded hardware devices lack exploit mitigations like stack canaries and Address Space Layout Randomization (ASLR), making successful code execution a realistic threat.

Technical Details of the Flaw

The vulnerability involves two independent overflow sites within the DHCPv6 request-processing path. In both scenarios, crafted IA options lead to insufficient space in a fixed 512-byte stack buffer, allowing additional reply data to be appended without proper bounds checking. The exploit is triggered by an unauthenticated DHCPv6 REQUEST sent to UDP port 547.

Impact and Mitigation

While there is no reported evidence of in-the-wild exploitation as of July 28, the severity of the flaw necessitates immediate action. Users on the 24.10 branch should upgrade to 24.10.8, and those on the 25.12 branch should install 25.12.5. Firmware images are available via the OpenWrt Firmware Selector.

The advisory includes public Python proof-of-concept code for both documented overflow paths, underscoring the ease with which this vulnerability could be exploited.

Additional Security Findings

Alongside these critical fixes, a separate AI-assisted audit by Hacker House identified command-injection, path-traversal, and cross-site scripting (XSS) weaknesses in optional LuCI components. OpenWrt also discovered a separate stored-XSS issue and missing cross-site request forgery (CSRF) protection during its own review. These LuCI-related fixes were not included in OpenWrt 24.10.8 and were still under review as of July 28.