Live › vulnerability › CVE-2026-55606
Go to dashboardodhcpd, the DHCPv6/DHCPv4/router-advertisement server used by OpenWrt, reads a length field in network byte order as a native integer during DHCPv6 self-loop detection. On little-endian hosts a single unauthenticated DHCPv6 packet makes memcmp() read about 2560 bytes past a 128-byte stack buffer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Devices running OpenWrt 25.12 or earlier where odhcpd handles DHCPv6 on a network an attacker can send packets to, such as a LAN or a directly connected segment. Routers that do not run odhcpd for DHCPv6, or that only serve IPv4 DHCP, are less exposed; the sources do not say exactly which configurations trigger the overread.
No product ranges from the sources yet.
opkg list-installed | grep odhcpd to see the installed odhcpd versioncat /etc/openwrt_release; the sources say versions 25.12 and prior are affecteduci show dhcp and look for dhcpv6 settings on the lan interfaceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
This page as .md · .json · in your agent: get_signal("CVE-2026-55606")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.