Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
A critical DHCPv6 stack overflow in OpenWrt's odhcpd service allows an unauthenticated attacker to run code as root. The flaw, tracked as CVE-2026-53921, can be exploited by sending a crafted DHCPv6 REQUEST to UDP port 547. OpenWrt has released version 24.10.8 to close th…
Intelligence analysis by Llama
A critical flaw in OpenWrt's DHCPv6 service allows an unauthenticated attacker to run code as root. The issue, tracked as CVE-2026-53921, can be exploited by sending a crafted DHCPv6 REQUEST to UDP port 547. OpenWrt has released version 24.10.8 to close the issue.
Imagine you're sending a message to a router, but the message is too big for the router's inbox. The router gets confused and lets the attacker take control of the router. This is a big problem because the attacker can do anything they want with the router.
Analysis
A Critical Flaw in OpenWrt's DHCPv6 Service
The critical issue, tracked as CVE-2026-53921, is a DHCPv6 stack overflow in OpenWrt's odhcpd service. This flaw allows an unauthenticated attacker to overwrite a stack buffer in odhcpd through a crafted DHCPv6 REQUEST. The attacker needs to be able to reach the DHCPv6 server, which is typically accessible from the network.
The advisory associated with CVE-2026-53921 documents two independent overflow sites in the DHCPv6 request-processing path. In both, crafted IA options leave insufficient space in a fixed 512-byte stack buffer before the code appends additional reply data without a sufficient bounds check. The final trigger is an unauthenticated DHCPv6 REQUEST sent to UDP port 547.
The first path's proof of concept creates five IA_NA bindings with an earlier SOLICIT; the second is triggered by a single crafted REQUEST. The advisory lists odhcpd master at commit e432dd6 and all earlier versions containing dhcpv6_ia_handle_IAs() and build_ia() as affected. OpenWrt lists 24.10.8 and 25.12.5 as the supported releases carrying the relevant odhcpd security update.
The advisory associates its two documented sites under CVE-2026-53921, while the release notes list RECONF_ACCEPT separately without a CVE. The exact mapping remains unclear. OpenWrt's release notes describe the flaw as reachable by a network-adjacent, unauthenticated attacker. The advisory's CVSS 3.1 vector uses AV:N (Network), not AV:A (Adjacent), and neither source explains the difference.
An attacker still needs network access to the DHCPv6 service. Successful exploitation could give the attacker control of the router rather than merely crash the service. The 24.10.8 release also addresses other pre-authentication weaknesses in odhcpd, including an out-of-bounds write, use-after-free, memory disclosure, denial of service, stack over-read and neighbour-discovery proxy spoofing.
Other default-service fixes cover three HTTP request-smuggling bugs in uhttpd and a DHCPv6 hostname-injection flaw, tracked as CVE-2026-62948, that can produce stored XSS when an administrator opens the LuCI leases page. The same release includes CVE-2026-62947 in cgi-io, which can expose arbitrary root-readable files through path traversal. That issue requires an authenticated session with the cgi-io download permission and an applicable wildcard file-read grant. It is not an anonymous file-read flaw.
OpenWrt 24.10 is under security maintenance, with end of life projected for September 2026. The project recommends migrating to the 25.12 series before then. Packages installed separately from the firmware image may also require separate updates.
Key points
- A critical flaw in OpenWrt's DHCPv6 service allows an unauthenticated attacker to run code as root.
- The issue, tracked as CVE-2026-53921, can be exploited by sending a crafted DHCPv6 REQUEST to UDP port 547.
- OpenWrt has released version 24.10.8 to close the issue.
- The flaw is reachable by a network-adjacent, unauthenticated attacker.
- Successful exploitation could give the attacker control of the router rather than merely crash the service.
If OpenWrt updates its firmware regularly, the risk of exploitation will decrease. Additionally, the release of the fix for CVE-2026-53921 will help to prevent attacks on the DHCPv6 service.
If users do not update their OpenWrt firmware, they will be vulnerable to attacks on the DHCPv6 service. This could lead to a loss of control over the router and potentially allow an attacker to access sensitive information.
