OpenWrt patches critical DHCPv6 flaw that could give attackers root control

OpenWrt released versions 24.10.8 and 25.12.5 on July 28, 2026, to fix CVE-2026-53921, a critical DHCPv6 vulnerability rated 9.8 under CVSS 3.1. An unauthenticated attacker who can reach the DHCPv6 service may exploit the flaw to execute code as root.

Why the DHCPv6 vulnerability is dangerous

The issue affects odhcpd, OpenWrt’s DHCP and router-advertisement daemon. A crafted DHCPv6 REQUEST sent to UDP port 547 can cause data to be written beyond a fixed 512-byte stack buffer. Because odhcpd runs as root, successful exploitation could compromise the router rather than merely terminate the service.

Risk is amplified by the characteristics of embedded hardware. OpenWrt notes that such devices often lack stack canaries and address space layout randomization, making practical code execution more realistic. Public Python proof-of-concept code covers both documented overflow paths.

Affected versions and additional fixes

The vulnerable code includes odhcpd master at commit e432dd6 and earlier versions containing dhcpv6_ia_handle_IAs() and build_ia(). OpenWrt corrected the writes by checking the remaining response-buffer capacity before appending data. Users on the 24.10 branch should install 24.10.8; those on 25.12 should move to 25.12.5.

The 24.10.8 release also addresses other pre-authentication defects in odhcpd, three HTTP request-smuggling bugs in uhttpd, and CVE-2026-62948, a hostname-injection flaw that can produce stored XSS in the LuCI leases page. CVE-2026-62947 fixes authenticated path traversal in cgi-io that could expose root-readable files under specific permissions.

Separate LuCI command-injection, path-traversal, XSS and CSRF fixes identified during an AI-assisted Hacker House audit were still under review on July 28 and were not included in 24.10.8. No exploitation of the disclosed issues had been reported in the wild at that date.

For businesses, the priority is to inventory OpenWrt gateways, deploy the supported firmware, update packages installed outside the firmware image and remove unused LuCI applications. Administrators should also review delegated permissions and ensure no luci-app-commands entry is simultaneously public and parameterised.