Critical Open Wrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
Summary: OpenWrt released version 24.10.8 to fix CVE-2026-53921, a DHCPv6 stack overflow rated 9.8 on CVSS 3.1 that lets an unauthenticated attacker reaching the DHCPv6 server overwrite a 512-byte stack buffer in odhcpd, which runs as root, via a crafted REQUEST to UDP port 547. The advisory includes public Python proof-of-concept code for both overflow paths, and notes that embedded hardware commonly lacks stack canaries and ASLR; as of July 28 the flaw was not reported as exploited in the wild and was absent from CISA's KEV catalog version 2026.07.27.
Why it matters: A 9.8-rated, unauthenticated root code-execution flaw with public exploit code sits in a service enabled by default on OpenWrt routers, and the advisory's own reasoning is that typical embedded devices lack the stack canaries and ASLR that would otherwise blunt it. The release also carries fixes for uhttpd request smuggling, a DHCPv6 hostname-injection stored XSS (CVE-2026-62948), and cgi-io path traversal (CVE-2026-62947), while the LuCI pull request #8878 addressing Hacker House's findings was still open and unmerged on July 28.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-53921CVE-2026-62947CVE-2026-62948
- Related
- ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026