Critical OpenWrt DHCPv6 flaw enables potential root-level device compromise

Threat summary

Public proof-of-concept (PoC) exploit code is available for a critical vulnerability in OpenWrt's odhcpd service, which provides Dynamic Host Configuration Protocol version 6 (DHCPv6) and IPv6 Router Advertisement services and is included in many OpenWrt deployments.

The PoC appears intended to achieve code execution on vulnerable OpenWrt devices, reducing the technical effort required for threat actors to target affected systems. Public reporting has not yet confirmed whether the exploit works consistently across different hardware platforms and device configurations.

OpenWrt is an open-source operating system used on routers, gateways, access points, firewalls, and other network infrastructure devices. The affected component, odhcpd, provides IPv6 address assignment and network configuration services. Because the service runs with root privileges and is commonly enabled, successful exploitation can result in complete control of the affected device.

The flaw, tracked as CVE-2026-53921, is a critical stack-based buffer overflow with a Common Vulnerability Scoring System (CVSS) score of 9.8. The vulnerability is caused by insufficient bounds checking when processing specially crafted DHCPv6 Identity Association (IA) options during reply generation.

OpenWrt's advisory, published on June 18, 2026, identifies two separate ways to trigger the vulnerability, both through a single unauthenticated DHCPv6 REQUEST packet. A threat actor with network reachability to the DHCPv6 service can exploit the vulnerability without credentials. Because odhcpd runs with root privileges and is included in many OpenWrt deployments, successful exploitation can result in complete control of the affected device.

Common exploitation scenarios could include:

• Access to the same local network segment as the OpenWrt device.
• Access to a connected branch, retail, warehouse, or operational network where the device is deployed.
• A compromised endpoint already present on the network.

Affected versions are:

• OpenWrt 24.10.0 through 24.10.7
• OpenWrt 25.12.0 through 25.12.4

Recommendations

OpenWrt is a Linux-based operating system used in routers, gateways, firewalls, wireless access points, and other network infrastructure devices. Identifying affected devices can be challenging because OpenWrt is often embedded within third-party networking products and custom appliances, meaning administrators may see only the vendor's model number and management interface rather than the underlying operating system.

Common examples of direct OpenWrt deployments include:

• Branch office routers running OpenWrt firmware
• Wireless access points managed directly by the organization
• Lab and testing environments
• Custom firewalls and network gateways built on commodity hardware

Examples of products that may use OpenWrt as an embedded platform include:

• Industrial Internet of Things (IoT) gateways
• Cellular, Long-Term Evolution (LTE), and 5G routers deployed at remote sites
• Software-Defined Wide Area Network (SD-WAN) edge appliances
• Retail and point-of-sale networking equipment
• Building automation and smart infrastructure controllers
• Specialized networking appliances from original equipment manufacturers (OEMs)

While there is no public evidence that CVE-2026-53921 has been exploited in the wild, vulnerabilities with similar characteristics have frequently attracted threat actor interest because they affect network infrastructure devices, require no authentication, and can provide administrative control of the device.

For organizations responding to CVE-2026-53921, an important first step is identifying whether OpenWrt is deployed directly on managed devices or embedded within third-party networking products, as remediation may require vendor-supplied firmware updates rather than a standard OpenWrt upgrade. OpenWrt has released fixes in versions 24.10.8 and 25.12.5.

Organizations are advised to review whether DHCPv6 is required, and limit DHCPv6 exposure to trusted network segments until updates are applied.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up