Live › vulnerability › CVE-2026-53921
Go to dashboardodhcpd, the DHCP and router-advertisement server on OpenWrt, has a stack buffer overflow in its DHCPv6 handler triggered by one crafted REQUEST packet. A remote attacker with no login can run code as root on the router.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Run odhcpd -v or check the installed OpenWrt package version (for example opkg list-installed | grep odhcpd) and compare it against 25.12.
Upgrade odhcpd to version 25.12 or later, which contains the patch.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler writes past the end of a fixed 512-byte stack buffer (pdbuf) when a single DHCPv6 REQUEST carries enough IA options to nearly exhaust the reply space. Two independent overflow sites exist in the same call chain, both reachable from the network via a single unauthenticated UDP packet. odhcpd runs as root on OpenWrt; embedded targets often lack stack canaries and ASLR, making code execution realistic. This issue has been patched in version 25.12.
This page as .md · .json · in your agent: get_signal("CVE-2026-53921")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.