Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

OpenWrt released a critical patch (v24.10.8) for CVE-2026-53921, a stack overflow in the DHCPv6 service (odhcpd) that allows unauthenticated remote code execution as root. Any unpatched OpenWrt device is exploitable by sending crafted DHCPv6 packets. This affects routers and edge devices across enterprise and ISP networks.

CRITICALAdvisoryJul 29, 2026

Action required

Identify all OpenWrt devices in your environment and immediately patch to version 24.10.8 or later. If you cannot patch immediately, isolate devices from untrusted networks or disable DHCPv6 service.

Affected products

OpenWrtodhcpduhttpdLuCI

CVE IDs

CVE-2026-53921

Linked articles

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

Source links

https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html