OpenWrt has released version 24.10.8 to address a critical DHCPv6 vulnerability (CVE-2026-53921) with a CVSS score of 9.8 that allows unauthenticated attackers to execute arbitrary code with root privileges. The flaw involves a stack buffer overflow in the odhcpd service that can be exploited remotely through crafted DHCPv6 packets. The update also patches additional remotely exploitable vulnerabi
OpenWrt has shipped version 24.10.8 to close a critical DHCPv6 stack overflow and a wider set of remotely triggerable flaws in network services enabled by default. The critical issue, tracked as CVE-2026-53921 and rated 9.8 on CVSS 3.1 in OpenWrt's GitHub advisory, lets an unauthenticated attacker able to reach the DHCPv6 server overwrite a stack buffer in odhcpd through a crafted DHCPv6
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
