Critical OpenWrt DHCPv6 Flaw CVE-2026-53921 Allows Unauthenticated Remote Code Execution as Root

OpenWrt has released versions 24.10.8 and 25.12.5 to patch a critical DHCPv6 stack overflow vulnerability, CVE-2026-53921, rated 9.8 on CVSS 3.1. The flaw allows an unauthenticated attacker to overwrite a stack buffer in odhcpd via a crafted DHCPv6 REQUEST, potentially leading to remote code execution as root. Embedded hardware often lacks stack canaries and ASLR, increasing exploitability. The advisory includes public Python proof-of-concept code for two overflow paths. Users on the 24.10 branch should upgrade to 24.10.8, and those on 25.12 to 25.12.5. As of July 28, no exploitation in the wild has been reported, and the flaw is absent from CISA’s KEV catalog.

Additionally, an AI-assisted audit by Hacker House identified command-injection, path-traversal, and XSS weaknesses in optional LuCI components. OpenWrt also found a stored-XSS issue and missing CSRF protection. These LuCI fixes remain under review. The release also addresses other pre-authentication weaknesses in odhcpd, including out-of-bounds write, use-after-free, memory disclosure, denial of service, stack over-read, and neighbor-discovery proxy spoofing. Other fixes cover HTTP request-smuggling in uhttpd (CVE-2026-62948) and a path traversal in cgi-io (CVE-2026-62947).