OpenWrt has patched a critical 9.8-rated DHCPv6 flaw that could let unauthenticated attackers execute code as root, while an AI-assisted security audit exposed additional vulnerabilities across its networking ecosystem.
OpenWrt has released versions 24.10.8 and 25.12.5 to fix CVE-2026-53921, a critical CVSS 9.8 vulnerability that could allow unauthenticated attackers to execute arbitrary code as root through the project’s DHCPv6 server. The flaw stems from a stack buffer overflow in odhcpd, triggered by a crafted DHCPv6 REQUEST packet. Since odhcpd runs as root and many embedded devices lack protections such as stack canaries and ASLR, successful exploitation could result in complete router compromise.
OpenWrt has also published Python proof-of-concept code demonstrating both documented overflow paths. As of July 28, there were no known reports of active exploitation, and the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalogue.
Beyond the critical RCE, the release fixes several remotely triggerable issues, including out-of-bounds writes, use-after-free, memory disclosure, denial of service, stack over-read, neighbour-discovery proxy spoofing, HTTP request smuggling in uhttpd, DHCPv6 hostname injection, stored XSS and path traversal vulnerabilities.
Separately, an AI-assisted security audit by Hacker House uncovered command injection, path traversal, stored XSS and directory traversal flaws in optional LuCI components, while OpenWrt identified additional stored XSS and missing CSRF protection issues during remediation. AI supported vulnerability discovery, triage and patch review, but researchers manually validated all reported flaws. OpenWrt recommends upgrading to 24.10.8 or 25.12.5, updating separately installed packages and reviewing LuCI configurations and permissions.
