OpenWrt, the open-source firmware that powers millions of home routers and embedded network devices, has released version 24.10.8 (and 25.12.5 for the newer branch) to fix a critical stack overflow in odhcpd, its DHCPv6 server daemon. The flaw, tracked as CVE-2026-53921 with a CVSS 3.1 score of 9.8, lets an unauthenticated attacker who can reach the router’s DHCPv6 service overwrite a stack buffer by sending a specially crafted DHCPv6 REQUEST packet. Because odhcpd runs as root and most embedded routers lack stack protection features such as canaries and address space layout randomisation (ASLR), a successful attack gives the attacker full control of the device. Public proof-of-concept code for both documented overflow paths was included in the security advisory, making exploitation straightforward.
The 24.10.8 release also closes a batch of additional weaknesses: an out-of-bounds write, a use-after-free, memory disclosure, denial-of-service, and stack over-read flaws in odhcpd, three HTTP request-smuggling bugs in the uhttpd web server, and a DHCPv6 hostname-injection issue (CVE-2026-62948) that can produce stored cross-site scripting when an administrator opens the LuCI leases page. A separate AI-assisted audit by Hacker House also found command-injection, path-traversal, and XSS weaknesses in optional LuCI components, though those fixes are in a separate pending release. As of July 28, there are no confirmed reports of active exploitation in the wild, but the public PoC significantly lowers the barrier for attackers.
How to check if you’re affected
Affected devices are routers or embedded systems running OpenWrt versions before 24.10.8 on the 24.10 branch, or before 25.12.5 on the 25.12 branch. Check your current version in the OpenWrt web interface under System → Firmware, or run ubus call system board | jsonfilter -e @.release.version from the command line. Firmware images for all supported hardware are available through the OpenWrt Firmware Selector at firmware-selector.openwrt.org.