Introduction
On July 28, 2026, OpenWrt released version 24.10.8 fixing a critical vulnerability in odhcpd -- the DHCPv6/DHCPv4/RA server enabled by default on every OpenWrt router. Tracked as CVE-2026-53921 (CVSS 9.8), this flaw allows unauthenticated, network-adjacent attackers to achieve remote code execution as root via two independent stack buffer overflows in the DHCPv6 Identity Association (IA) reply serialization, both reachable via a single crafted UDP packet to port 547.
This article provides a technical analysis of both overflow sites, exploitation constraints on embedded targets, and practical mitigation guidance.
Vulnerability Details
CVE-2026-53921 -- Stack Buffer Overflow in DHCPv6 IA Reply Serialization
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-53921 |
| CVSS 3.1 | 9.8 (Critical) -- AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Component | odhcpd (DHCPv6 server) |
| Affected | odhcpd master (e432dd6) and all prior versions with dhcpv6_ia_handle_IAs() / build_ia() |
| Fixed | OpenWrt 24.10.8 (d329a15 + 0320032 + 03dacc2) / 25.12.5 (d168c27 + 6634b7a + 2a42d34) |
| Vector | Network (UDP/547) |
Root Cause Analysis
odhcpd runs as root. When processing a DHCPv6 REQUEST, the server constructs replies in a fixed 512-byte stack buffer (pdbuf). Two code paths write past the buffer end without adequate bounds checking.
Site 1: build_ia() Status-Option Overflow (dhcpv6-ia.c:594)
When an IA enters the error-status path (e.g., NOTONLINK for off-link addresses), build_ia() checks only buflen >= sizeof(struct dhcpv6_ia_hdr) (16 bytes) before appending a 6-byte status sub-option -- writing 22 bytes total without verifying space.
Trigger: A relay-forwarded REQUEST with 5 valid IA_NA bindings plus 7 IA_NAs with off-link IA_ADDR. Each success consumes ~72 bytes. Five successes = 360 bytes. Six NOTONLINK replies × 22 bytes = 132 bytes. The 7th needs 22 bytes but only 20 remain -- 2-byte overflow.
ASan: WRITE of size 2 in build_ia at dhcpv6-ia.c:594 at offset 1376.
Site 2: RECONF_ACCEPT Overflow (dhcpv6-ia.c:1246)
When the first assigned IA has accept_reconf set, the handler unconditionally writes a 4-byte RECONF_ACCEPT option plus 32-byte auth record (36 bytes total) with zero bounds checking:
Trigger: A REQUEST with RECONF_ACCEPT, 22 unassignable IA_PD options (each 22-byte status = 484 bytes), and one final IA_NA. After 22 failures, 28 bytes remain. The 36-byte handshake overflows by 8+ bytes, and unsigned subtraction underflows, corrupting size tracking.
ASan: WRITE of size 15 at dhcpv6_ia_handle_IAs dhcpv6-ia.c:1262 at offset 1376.
Impact & Affected Systems
What Is at Risk
- Full device compromise: odhcpd runs as root; exploitation yields root shell
- Network pivot: Compromised routers become footholds for lateral movement
- Persistence: Firmware-level implants survive reboots/updates (unless clean reflash)
- Botnet recruitment: Millions of OpenWrt devices exposed to IPv6 DHCPv6 on WAN
Affected Platforms
| Platform | Status |
|---|---|
| OpenWrt 24.10.x (< 24.10.8) | Vulnerable |
| OpenWrt 25.12.x (< 25.12.5) | Vulnerable |
| OpenWrt 23.05 and older | Vulnerable (EOL, no patches) |
| Custom builds with odhcpd master | Vulnerable if pre-fix |
Note: Only reachable when DHCPv6 server is enabled (default on LAN). Devices with IPv6 disabled or DHCPv6 stopped are not directly exposed.
Embedded Exploitation Reality
The advisory notes: "embedded hardware commonly lacks stack canaries and ASLR, making code execution a realistic outcome."
| Mitigation | Typical Embedded Status |
|---|---|
| Stack Canaries | Often disabled (size/performance) |
| ASLR | Often disabled or partial |
| NX/DEP | Usually enabled |
| RELRO | Partial |
Without stack canaries and ASLR, a controlled stack overflow directly overwrites return addresses or function pointers, enabling reliable ROP/JOP chains. The 2-byte and 8+ byte overflows suffice to corrupt adjacent stack frames or saved registers.
Who Needs to Act
Immediate action for:
- ISPs/enterprises deploying OpenWrt-based CPE
- IoT gateways and edge routers on 24.10 or 25.12
- Community mesh networks (Freifunk, NYC Mesh) using default DHCPv6
- Home users with OpenWrt routers exposing IPv6 to WAN
Lower priority (still patch):
- Devices with DHCPv6 server disabled
- Devices behind upstream firewall blocking UDP/547
- OpenWrt 23.05 users (EOL Sept 2024) -- migrate to 24.10.8 or 25.12.5
Mitigation & Patching
Primary Fix: Upgrade Firmware
| Current | Upgrade To | Method |
|---|---|---|
| 24.10.x | 24.10.8 | Sysupgrade / Firmware Selector |
| 25.12.x | 25.12.5 | Sysupgrade / Firmware Selector |
| 23.05 or older | 24.10.8 or 25.12.5 | Clean install recommended |
Download: Firmware Selector or Direct
Workarounds (If Upgrade Impossible)
-
Disable DHCPv6 on WAN interfaces:
bash -
Block UDP/547 at upstream firewall for untrusted networks
-
Disable IPv6 on WAN if not required:
bash
Post-Upgrade Verification
Detection
Network (Suricata)
Host (YARA)
Log Monitoring
Frequently Asked Questions
Q: Exploitable over the Internet (WAN)? A: Only if router accepts DHCPv6 on WAN (IPv6 passthrough or native IPv6 WAN with DHCPv6 server). Most home routers run DHCPv6 on LAN only. ISP-managed CPE often runs DHCPv6 on WAN for prefix delegation -- those are directly exposed.
Q: Affects devices with IPv6 disabled?
A: No. If IPv6 disabled (ipv6='0' in /etc/config/network), odhcpd does not bind to UDP/547.
Q: Known exploits in the wild? A: As of July 28, 2026, neither OpenWrt's advisory nor The Hacker News reported active exploitation. The public PoC requires ASan-instrumented build; weaponization needs ROP chain development.
Q: What about LuCI XSS (CVE-2026-62948)? A: Separate Critical issue in same release. Unauthenticated DHCPv6 client injects JavaScript via crafted FQDN hostname, executing when admin views LuCI DHCPv6 leases page. Fixed by escaping hostnames in lease state file. Upgrade to 24.10.8 addresses both.
Q: Why two overflows under one CVE? A: OpenWrt's advisory groups both IA reply bugs under CVE-2026-53921; release notes list RECONF_ACCEPT separately (High, no CVE). Mapping remains ambiguous -- treat both as Critical and patch immediately.
Q: Does this affect dnsmasq? A: No. dnsmasq is a separate DHCP/DNS server. This vulnerability is specific to odhcpd, OpenWrt's native DHCPv6/RA implementation.
Key Takeaways
-
Patch Immediately: CVE-2026-53921 is a CVSS 9.8 unauthenticated RCE in a default-enabled service. Upgrade to OpenWrt 24.10.8 or 25.12.5 today.
-
Embedded Devices Are Soft Targets: Lack of stack canaries and ASLR on typical router SoCs (MediaTek, Qualcomm Atheros, Broadcom) turns stack overflows into reliable code execution. Vendors must enable compiler hardening by default.
-
AI-Assisted Discovery Is Here: Hacker House found additional LuCI command injection, path traversal, and XSS flaws using LLM-driven "inference fuzzing" (Qwen 3.6 35B for recall, Claude Opus 4.6 for triage). Expect more AI-found vulnerabilities in embedded codebases.
-
Defense in Depth: Even with patched odhcpd, restrict UDP/547 to trusted networks, disable unused LuCI apps, and audit delegated admin permissions.
-
EOL Means No Patches: OpenWrt 23.05 reached EOL September 2024. Devices on 23.05 will never receive this fix -- plan migration to 24.10 or 25.12.
Conclusion
CVE-2026-53921 represents a severe vulnerability class: a pre-authentication stack buffer overflow in a root-privileged network service enabled by default on millions of embedded devices. Dual overflow sites, public PoC availability, and realistic exploitation path on unhardened targets make this a patch-now scenario.
Administrators should prioritize firmware upgrades, implement network segmentation to limit DHCPv6 exposure, and monitor for anomalous DHCPv6 traffic. The concurrent AI-assisted discovery of seven additional LuCI vulnerabilities underscores that the vulnerability discovery landscape is shifting -- automated reasoning over source code is becoming a force multiplier for both attackers and defenders.
Sources:
- OpenWrt 24.10.8 Release Notes
- GHSA-7fwx-hhrg-3496: odhcpd Stack Buffer Overflow
- The Hacker News: Critical OpenWrt DHCPv6 Flaw
- Hacker House: AI-Assisted Audit of OpenWrt LuCI
- OpenWrt Security Advisories
- CISA Known Exploited Vulnerabilities Catalog
#openwrt #cve-2026-53921 #dhcpv6 #buffer-overflow #rce #embedded-security #router-security #firmware
Automated Transmission
This entry was synthesized and populated dynamically using native API integrations.