Full Report
OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt's GitHub advisory, lets an unauthenticated attacker able to reach the DHCPv6 server overwrite a stack buffer in odhcpd through a crafted DHCPv6
Analysis Summary
# Vulnerability: Critical Stack Overflow in OpenWrt DHCPv6 Service (odhcpd)
## CVE Details
- **CVE ID:** CVE-2026-53921
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-121 (Stack-based Buffer Overflow)
## Affected Systems
- **Products:** OpenWrt (specifically the `odhcpd` daemon)
- **Versions:**
- OpenWrt 24.10 versions prior to 24.10.8
- OpenWrt 25.12 versions prior to 25.12.5
- All versions of `odhcpd` containing `dhcpv6_ia_handle_IAs()` and `build_ia()` (up to commit `e432dd6`)
- **Configurations:** Devices running the default DHCPv6 server. Note that embedded hardware often lacks modern exploit mitigations like ASLR and stack canaries, increasing the reliability of exploitation.
## Vulnerability Description
A critical stack buffer overflow exists in the `odhcpd` component of OpenWrt. The flaw occurs during the processing of crafted DHCPv6 `IA` (Identity Association) options within a `REQUEST` packet. The software uses a fixed 512-byte stack buffer to build replies; however, it fails to perform sufficient bounds checking before appending additional data. An unauthenticated attacker can overwrite the stack buffer by sending a specially crafted DHCPv6 packet to UDP port 547. Since `odhcpd` runs with root privileges, successful exploitation allows for full system compromise.
## Exploitation
- **Status:** PoC available (Python scripts for two separate overflow paths). No known exploitation in the wild as of July 28, 2026.
- **Complexity:** Low
- **Attack Vector:** Network (While some documentation suggests "Adjacent," the CVSS vector is rated as "Network" reachability).
## Impact
- **Confidentiality:** High (Full system access as root)
- **Integrity:** High (Ability to modify router configuration and firmware)
- **Availability:** High (Can lead to device crashes or persistent takeover)
## Remediation
### Patches
Users should update to the following versions via the OpenWrt Firmware Selector:
- **OpenWrt 24.10.8**
- **OpenWrt 25.12.5**
### Workarounds
- Disable the DHCPv6 server if not required.
- Implement firewall rules to restrict access to UDP port 547 to trusted local interfaces only.
## Detection
- **Indicators of Compromise:** Unexpected crashes or restarts of the `odhcpd` process; unusual network traffic on UDP port 547 containing repeated or malformed IA_NA options.
- **Detection Methods:** Monitor system logs for `odhcpd` segmentation faults. Security teams can use the public Python PoC to scan internal devices for vulnerability.
## References
- **OpenWrt Advisory:** hxxps[://]github[.]com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496
- **Release Notes:** hxxps[://]github[.]com/openwrt/openwrt/releases/tag/v24.10.8
- **Technical Analysis:** hxxps[://]thehackernews[.]com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html