"CVE-2026-53921...lets an unauthenticated attacker able to reach the DHCPv6 server overwrite a stack buffer in odhcpd through a crafted DHCPv6 REQUEST." — OpenWrt GitHub advisory
The DHCPv6 overflow: CVE-2026-53921 and odhcpd
OpenWrt's GitHub advisory rates CVE-2026-53921 at 9.8 (CVSS 3.1) and documents two independent stack-overflow sites in the DHCPv6 request path of odhcpd. In both cases, crafted IA options leave insufficient room in a fixed 512‑byte stack buffer before reply data is appended without an adequate bounds check. The final trigger is an unauthenticated DHCPv6 REQUEST sent to UDP port 547; one proof-of-concept requires five IA_NA bindings created by an earlier SOLICIT, the other is triggered by a single crafted REQUEST.
odhcpd runs as root, and OpenWrt notes that "embedded hardware commonly lacks stack canaries and address space layout randomization (ASLR)," making code execution a realistic outcome on many devices. The advisory includes public Python proof-of-concept code for the documented overflow paths. OpenWrt lists odhcpd master at commit e432dd6 and earlier versions containing dhcpv6_ia_handle_IAs() and build_ia() as affected.
Patches and release guidance: OpenWrt 24.10.8 and 25.12.5
OpenWrt shipped 24.10.8 to close the DHCPv6 stack overflow and a wider set of remotely triggerable flaws in default-enabled network services; users on the 24.10 branch should install 24.10.8. Users on 25.12 should install 25.12.5. The fixes remove the unsafe writes by checking remaining response-buffer capacity before appending data. Firmware images are available through the OpenWrt Firmware Selector.
The 24.10.8 release also addresses multiple pre-authentication weaknesses in odhcpd (including an out-of-bounds write, use-after-free, memory disclosure, denial-of-service, stack over-read and neighbour-discovery proxy spoofing), three HTTP request-smuggling bugs in uhttpd, and a DHCPv6 hostname-injection flaw (CVE-2026-62948) that can produce stored XSS when an administrator opens the LuCI leases page. A separate issue in cgi-io, CVE-2026-62947, can expose arbitrary root-readable files via path traversal but requires an authenticated session with cgi-io download permission plus an applicable wildcard file-read grant.
OpenWrt notes 24.10 is under security maintenance with end-of-life projected for September 2026 and recommends migrating to 25.12. Packages installed separately from firmware images may require separate updates.
Hacker House AI-assisted audit and LuCI pull request #8878
Hacker House reported a separate, AI-assisted audit identifying multiple issues in optional LuCI components, including command-injection, path-traversal and stored XSS. OpenWrt maintainer Hauke Mehrtens published LuCI pull request #8878 on July 26, explicitly crediting Matthew Hickey (Hacker Fantastic) and Hacker House. As of July 28, the pull request and a companion ddns-scripts pull request were still open and unmerged.
Hacker House described a four-stage inference-fuzzing process that uses Qwen 3.6 35B Heretic for broad recall and a frontier model such as Anthropic's Claude Opus 4.6 for higher-precision triage; Qwen 3.5 115B can be substituted for fully offline audits. Several proposed commits carry an Assisted-by: Claude:claude-opus-5 trailer and an automated review on the LuCI pull request says it was generated with Claude Code. Researchers manually confirmed reported findings where practical.
Pull request #8878 contains nine commits tied to Hacker House reports and additional issues OpenWrt discovered while preparing fixes. The security changes include fixes for:
- luci-app-commands: a bare pipe character allowed an application's argument allow-list to run commands as root; OpenWrt found it could work without a session cookie or CSRF token when an administrator configured a command as public='1' and param='1'.
- luci-app-ddns: ddns_dateformat could inject commands into root-run operations and service_name allowed path traversal; OpenWrt found a separate stored-XSS while preparing fixes.
- luci-proto-openvpn: attacker-controlled configuration values could reach shell commands via keytype and key-directory parameters exposed path traversal.
- luci-app-olsr: a malicious mesh node could announce a crafted hostname that executes a script in the browser when an administrator views the OLSR neighbours page.
OpenWrt said the unauthenticated luci-app-commands path has material preconditions: the optional application must be installed and an administrator must have deliberately exposed a parameterised command as public. Other command-execution paths require authenticated LuCI access and relevant permissions; successful exploitation runs commands as root.
What this means for administrators, OpenWrt maintainers, and auditors
- Administrators and end users: Install OpenWrt 24.10.8 or 25.12.5, update separately installed packages, review delegated LuCI permissions, remove optional applications not in use, and check whether any luci-app-commands entries are both public and parameterised.
- OpenWrt maintainers: reconcile advisory and release-note CVE mapping (OpenWrt grouped both overflow sites under CVE-2026-53921 while 24.10.8 release notes listed RECONF_ACCEPT separately without a CVE), backport fixes already merged on master to release branches, and complete review and merging of PRs #8878 and the ddns-scripts patch.
- Security auditors and tool builders: note that Hacker House combined AI-assisted inference-fuzzing with manual validation and that proposed commits and automated reviews were assisted by Claude models and other LLMs; incorporate similar end-to-end validation safeguards when adopting model-assisted workflows.
Outstanding technical questions and immediate steps
As of July 28, OpenWrt's materials did not report exploitation in the wild, and the flaw was absent from CISA's Known Exploited Vulnerabilities catalog version 2026.07.27 — but OpenWrt's advisory provides public proof-of-concept code, raising urgency for patch adoption. The advisory's CVSS vector uses AV:N (Network) while release notes describe an attacker as network-adjacent and unauthenticated; neither source reconciles that wording difference. OpenWrt fixed the documented overflow paths by bounding writes, but several LuCI-related fixes remain under review and unmerged.
Administrators should prioritize firmware updates, remove or restrict optional LuCI applications they do not use, and verify delegated permissions and public parameterised commands. OpenWrt maintainers and auditors should complete the PR reviews and clarify CVE mappings and affected-version ranges to reduce operator uncertainty.
