OpenWrt releases security updates for critical DHCPv6 flaw and other vulnerabilities

As noted by The Hacker News, OpenWrt released version 24.10.8 to address a critical DHCPv6 stack overflow vulnerability (CVE-2026-53921) and a range of other remotely triggerable flaws in its network services.

The critical DHCPv6 vulnerability, rated 9.8 on CVSS 3.1, allows an unauthenticated attacker to overwrite a stack buffer in the odhcpd service by sending a crafted DHCPv6 REQUEST. This could lead to code execution on devices lacking security features like stack canaries and ASLR. The update also fixes other pre-authentication weaknesses in odhcpd, including an out-of-bounds write and memory disclosure, as well as HTTP request smuggling bugs in uhttpd and a DHCPv6 hostname injection flaw leading to stored XSS. Separately, an AI-assisted audit by Hacker House identified command-injection, path-traversal, and cross-site scripting (XSS) weaknesses in optional LuCI components, along with a stored XSS issue and missing CSRF protection. While the critical DHCPv6 fix is included in OpenWrt 24.10.8 and 25.12.5, the LuCI-related patches were still under review as of July 28. No exploitation in the wild had been reported for these vulnerabilities at the time of the advisory. OpenWrt recommends users update to the latest versions and consider migrating to the 25.12 series.

Source: The Hacker News