OpenWrt: A '90s-Era Buffer Overflow Opens Routers to Remote…

A critical flaw in OpenWrt's DHCPv6 server allows pre-authentication remote code execution on routers. A public proof-of-concept exploit exists, and embedded hardware lacks basic mitigations like stack canaries and ASLR.

On July 28, 2026, OpenWrt disclosed a critical vulnerability in its DHCPv6 server that allows an unauthenticated network attacker to achieve code execution as root. The flaw, tracked as CVE-2026-53921 with a CVSS score of 9.8 per the project's GitHub advisory, exploits a classic stack buffer overflow in the serialization of DHCPv6 IA responses. The combination of a pre-authentication network exploit, an available Python proof-of-concept, and the absence of modern mitigations on embedded hardware makes the threat immediately concrete for routers and SOHO devices.

Key Takeaways

CVE-2026-53921 is a stack buffer overflow in OpenWrt's odhcpd DHCPv6 server with a CVSS 9.8 (Critical) rating per the project's GitHub advisory.
The attacker sends a crafted DHCPv6 REQUEST packet to UDP port 547; two independent overflow paths overwrite a fixed 512-byte stack buffer.
The advisory includes public Python PoC code for both documented exploit paths.
Embedded hardware typically lacks stack canaries and ASLR, making root code execution a realistic outcome according to the project's own advisory.

The Mechanism: How a DHCPv6 Packet Becomes Arbitrary Execution

The vulnerable functions are dhcpv6_ia_handle_IAs() and build_ia(), both in the odhcpd DHCPv6 request processing path. According to the cited advisory, the server uses a fixed 512-byte stack buffer to serialize IA (Identity Association) responses. When processing crafted IA options in a REQUEST packet, the code appends response data without sufficient bounds checks, overwriting the buffer.

Two independent trigger paths exist. The first requires five IA_NA bindings preceded by a SOLICIT message; the second triggers with a single, appropriately constructed REQUEST. In both cases, the attacker needs no authentication: the final packet is a standard DHCPv6 REQUEST sent to UDP port 547.

The odhcpd server runs with root privileges. Once the buffer is overwritten, execution flow can be redirected to shellcode injected via the packet. The project advisory explicitly states that "embedded hardware commonly lacks stack canaries and address space layout randomization (ASLR), making code execution a realistic outcome on typical devices".

"embedded hardware commonly lacks stack canaries and address space layout randomization (ASLR), making code execution a realistic outcome on typical devices" — OpenWrt GitHub advisory, reported by The Hacker News

Why the Public PoC Changes the Risk Timeline

The advisory includes public Python PoC code for both documented overflow paths. This element transforms CVE-2026-53921 from a theoretical vulnerability into an immediately replicable weapon: no firmware reverse engineering or advanced exploit development skills are required to build a working attack.

The publication of the exploit code is a deliberate choice by the OpenWrt project, likely intended to force updates given that a fix has existed for weeks. The release notes for version 25.12.5, dated July 1, 2026, already list CVE-2026-53921 as "Critical: stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST". The nearly four-week gap between the patch release and full public disclosure suggests a responsible embargo, but now exposes unpatched devices.

As of July 28, 2026, no reports of in-the-wild exploitation appear in the CISA KEV catalog version 2026.07.27. However, absence from this catalog does not constitute proof of non-exploitation: the KEV is retrospective by definition, and IoT/embedded devices rarely possess detection telemetry.

The Embedded Firmware "Perfect Storm": When Mitigations Are Missing

The core of the severity lies not just in the vulnerability itself, but in the ecosystem surrounding it. Consumer routers and SOHO devices running OpenWrt are built on low-cost MIPS and ARM platforms where modern mitigations are often disabled for performance reasons or simply not implemented by the bootloader.

Stack canaries require compiler and runtime support; ASLR requires a functional MMU and a kernel that randomizes the address space. On many embedded SoCs, these conditions do not exist. The result is that a '90s-era buffer overflow—an attack that would be caught or rendered impractical on modern general-purpose systems—remains lethal in 2026.

The DHCPv6 server is also enabled by default on many OpenWrt configurations that provide IPv6 on the LAN or receive delegated prefixes from the ISP. This exposes the attack surface not only to the local network but potentially to upstream segments in provider scenarios, if the firewall does not adequately filter UDP 547 on the WAN.

Update Path and End of Life for the 24.10 Branch

The fix is available in commit e432dd6 of the odhcpd master branch. For stable users, the patched versions are 24.10.8 for the 24.10 branch and 25.12.5 for the 25.12 branch, the latter released on July 1, 2026.

The 24.10 branch is in security maintenance with an expected end of life in September 2026. Users remaining on this version face a dual pressure: the active vulnerability and the imminent cessation of support. The source does not specify whether the 25.12.5 fix was correctly backported to 24.10.8 or whether the latter contains undocumented regressions.

Why This Matters

The brief does not specify corrective measures or operational controls to activate beyond the firmware update. No recommendation emerges from the source regarding specific monitoring of UDP 547, network segmentation, or verification of the DHCPv6 configuration. The dossier does not quantify the number of devices actually exposed with the server enabled on the WAN interface rather than LAN only.

It also remains uncertain whether the RECONF_ACCEPT variant mentioned in the advisory is part of CVE-2026-53921 or constitutes a separate vulnerability without an assigned identifier. The source does not clarify this mapping, nor does it document whether adjacent access vector (AV:A) attack conditions exist beyond the network vector (AV:N) already cited.

The nature of the risk—critical network infrastructure with an existing patch but fragmented deployment, combined with a public PoC and absent hardware mitigations—creates the technical conditions for systemic compromise. The speed of adoption of the 24.10.8 update in the coming days will be the determining parameter for containing, or not, a potential mass event.

Information is based on the cited source and current as of publication.

Sources

Sources and references