OpenWrt Patches Critical DHCPv6 Flaw Enabling Remote Root Access
A stack buffer overflow in the default odhcpd daemon lets unauthenticated attackers execute code with root privileges on vulnerable routers.
OpenWrt has released emergency firmware updates to patch a critical stack buffer overflow in its default network daemon that could allow attackers to gain root access to routers remotely.
The vulnerability, tracked as CVE-2026-53921, resides in odhcpd—the service that handles DHCPv6, DHCPv4, and Router Advertisements on virtually all OpenWrt installations. An unauthenticated attacker on the local network can trigger the flaw by sending a single crafted DHCPv6 REQUEST packet.
The Technical Flaw
The overflow occurs during DHCPv6 IA reply serialization, where odhcpd writes data into a 512-byte stack buffer named 'pdbuf'. When exploited, this allows an attacker to overwrite the stack and potentially execute arbitrary code.
The risk is amplified by embedded hardware realities. odhcpd runs as root, and many router targets lack modern exploit mitigations like Address Space Layout Randomization (ASLR) and stack canaries. As the OpenWrt security advisory notes, this combination makes successful code execution "realistic."
Patches Released
OpenWrt 24.10.8, released July 25, 2026, addresses CVE-2026-53921 along with over a dozen other remotely exploitable vulnerabilities. The fix is also included in version 25.12.5. Users should update immediately, particularly on devices exposed to untrusted local networks.
The GitHub Security Advisory (GHSA-7fwx-hhrg-3496) rates the vulnerability as Critical. An official CVSS score from NIST's NVD has not been published.
Additional Vulnerabilities
The July 25 release also patches CVE-2026-62948, a separate stored cross-site scripting flaw. According to Lunar Computer, this issue allows a rogue DHCPv6 client to inject a crafted hostname into the lease file, which then executes malicious JavaScript in the LuCI admin interface when viewed by an administrator.
Why This Matters
This vulnerability represents a worst-case scenario for router security: a default, network-facing service that requires no authentication and no user interaction to exploit. The combination of root privileges and the absence of hardware-level mitigations on embedded devices makes timely patching essential.
OpenWrt powers countless home and enterprise routers worldwide. Because these devices often operate unattended for years, many remain vulnerable long after patches are available. Administrators should verify their firmware version and update without delay.