← Back to Feed

Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root

CVE-2026-53921

July 28, 2026 · The Hacker News · Severity: CRITICAL

OpenWrt released version 24.10.8 to fix CVE-2026-53921 (CVSS 9.8), a critical DHCPv6 stack overflow in odhcpd that lets unauthenticated attackers execute code as root. Embedded hardware commonly lacks stack canaries and ASLR, making exploitation realistic in typical deployments. Public Python proof-of-concept code has been released for both documented overflow paths.

Key Takeaways

  • CVE-2026-53921 (CVSS 9.8) is a critical DHCPv6 stack overflow in OpenWrt's odhcpd daemon
  • Unauthenticated attackers can trigger the overflow via crafted DHCPv6 REQUEST packets remotely
  • odhcpd runs as root, and embedded hardware commonly lacks stack canaries and ASLR protections
☕ Buy a Coffee