A critical stack buffer overflow in odhcpd, the DHCPv6 server component bundled with OpenWrt, allows an unauthenticated attacker who can reach the DHCPv6 service to execute arbitrary code with root privileges on the router. CVE-2026-53921, rated CVSS 9.8, was patched in OpenWrt 24.10.8, released July 28, alongside a wider set of remotely triggerable fixes for network services. OpenWrt runs on millions of routers, access points, and embedded networking devices worldwide, and DHCPv6 is enabled by default on many standard OpenWrt configurations.
The Stack Overflow in odhcpd and How It Triggers
CVE-2026-53921 involves a stack buffer overflow in odhcpd, the daemon responsible for handling DHCPv6 address assignment in OpenWrt environments. An attacker sends a crafted DHCPv6 message — malformed in a way that overflows a fixed-size buffer on the stack — overwriting adjacent stack memory and gaining control of execution flow. Because odhcpd operates as root and receives DHCPv6 messages without requiring any prior authentication or session establishment, the attack requires no credentials and no precondition beyond network adjacency to a router running the vulnerable service.
The DHCPv6 protocol operates at the network layer and is active whenever IPv6 address management is in use. On the typical OpenWrt deployment, the service is on by default and listens on the local network interface — a configuration that makes it reachable to any device on the same network segment without additional firewall rules to block it.
Root-Level Access and What That Means for Network Traffic
Root access to an OpenWrt router grants an attacker complete control over every function of the device. All inbound and outbound traffic flowing through the router is visible and modifiable: HTTP and HTTPS sessions can be intercepted if TLS termination is manipulated, DNS responses can be rewritten to redirect users to attacker-controlled hosts, VPN tunnels can be disrupted, and NAT rules can be altered to expose internal hosts. The router also serves as an ideal pivot point for further attacks against devices on the same network segment, which on home and small-office deployments typically includes computers, phones, smart home devices, and NAS systems.
A firmware-level backdoor installed by an attacker with root access would survive a standard factory reset in most router models, as factory resets typically restore the user-visible configuration but preserve the underlying firmware image. Full remediation of a compromised OpenWrt device requires reflashing the firmware from a known-good source.
Scope: 24.10.x Releases Before 24.10.8
CVE-2026-53921 affects OpenWrt 24.10.x releases before version 24.10.8. OpenWrt 24.10.8 patches this vulnerability and a broader set of remotely triggerable flaws in network services that were fixed in the same release. Users running OpenWrt 24.10.x in any sub-version earlier than 24.10.8 are vulnerable.
Why Default DHCPv6 Enablement Widens the Attack Surface
The significance of the default-enabled DHCPv6 service cannot be understated from a scope perspective. Many vulnerabilities in networking firmware require non-default configuration to be exploitable — an administrator must have enabled a specific service or opened a specific port. CVE-2026-53921 requires no such prerequisite. Any router that has not been explicitly configured to disable DHCPv6, or that runs on a network where the service was left at its default state during setup, is reachable by any device on the local network segment without additional steps.
In enterprise and ISP deployments where OpenWrt powers managed access points and customer-premises equipment, the attack surface extends to every connected subscriber segment. An attacker positioned on any customer network sharing the same upstream distribution infrastructure can potentially reach CPE routers if DHCPv6 message handling is not confined to per-customer segments.
Patch and Immediate Remediation Steps
OpenWrt 24.10.8 is the patched release. Users on any 24.10.x sub-version should update immediately through the OpenWrt upgrade interface or by flashing the 24.10.8 firmware image. Organizations managing fleets of OpenWrt devices — including ISPs and enterprise networking teams — should push the update centrally. Disabling DHCPv6 on networks that do not use IPv6 addressing is a configuration-level mitigation that eliminates the attack surface for CVE-2026-53921 on affected devices where an immediate firmware update is not possible.
