OpenWrt has released version 24.10.8 to address a critical DHCPv6 vulnerability along with several remotely exploitable security issues affecting network services that are enabled by default. The most severe flaw, tracked as CVE-2026-53921 and assigned a CVSS 3.1 score of 9.8, affects the odhcpd service and could allow an unauthenticated attacker with network access to the DHCPv6 server to execute arbitrary code with root privileges by sending a specially crafted DHCPv6 REQUEST packet. According to OpenWrt’s advisory, odhcpd runs with root permissions, while many embedded devices lack security protections such as stack canaries and address space layout randomization, making successful code execution more practical on affected hardware. OpenWrt has released updated firmware through versions 24.10.8 and 25.12.5, and users have been advised to install the latest supported release using the OpenWrt Firmware Selector. As of July 28, there were no confirmed reports of active exploitation, and the vulnerability was not listed in CISA’s Known Exploited Vulnerabilities catalog.
The advisory explains that CVE-2026-53921 is caused by two independent stack overflow conditions during DHCPv6 request processing. In both cases, specially crafted Identity Association options leave insufficient space in a fixed 512 byte stack buffer before additional response data is written without adequate boundary validation. One proof of concept creates multiple IA_NA bindings through an earlier SOLICIT request, while the second can be triggered using a single crafted DHCPv6 REQUEST sent to UDP port 547. OpenWrt identified odhcpd master at commit e432dd6 and all earlier versions containing the affected functions as vulnerable. Although OpenWrt groups both overflow conditions under CVE-2026-53921, the release notes separately describe the RECONF_ACCEPT overflow without assigning it a dedicated CVE identifier, leaving the exact mapping between vulnerabilities and fixes unclear. The security update resolves the issue by verifying the remaining response buffer capacity before additional data is written. Besides the critical overflow, OpenWrt also corrected several other pre authentication weaknesses in odhcpd, including out of bounds writes, use after free conditions, memory disclosure, denial of service, stack over read issues, and neighbour discovery proxy spoofing vulnerabilities. The release also fixes three HTTP request smuggling vulnerabilities affecting uhttpd and addresses CVE-2026-62948, a DHCPv6 hostname injection flaw capable of producing stored cross site scripting when an administrator views the LuCI leases page.
The release also includes a fix for CVE-2026-62947 affecting cgi io, which could expose root readable files through path traversal under specific authenticated conditions. OpenWrt clarified that this vulnerability requires an authenticated user session with download permissions and appropriate wildcard file read access, meaning it is not an anonymous file disclosure issue. At the same time, OpenWrt continues reviewing additional LuCI security updates identified through an artificial intelligence assisted audit performed by Hacker House. The audit uncovered command injection, directory traversal, and cross site scripting vulnerabilities across several optional LuCI applications, while OpenWrt independently discovered an additional stored cross site scripting issue and missing cross site request forgery protection during its own review process. These LuCI related fixes remained under review as of July 28 and were not included in the 24.10.8 release. Researchers stated that some vulnerabilities require authenticated administrator access or optional applications to be installed, while one luci app commands scenario could become accessible without authentication if an administrator deliberately configured a command to be both public and parameterized. Other issues identified during the audit included vulnerabilities affecting luci app ddns, luci proto openvpn, luci app olsr, luci app bmx7, and luci app dockerman, with some already corrected in the main development branch but still awaiting backports to supported releases.
Hacker House explained that its OpenWrt security assessment used a four stage artificial intelligence assisted inference fuzzing methodology designed to identify potential software weaknesses before researchers manually verified them through source code inspection and runtime testing. According to the company, Qwen 3.6 35B Heretic was used during the initial discovery stage, while Anthropic Claude Opus 4.6 assisted with vulnerability triage. OpenWrt also confirmed that artificial intelligence contributed to portions of the remediation process, with several proposed commits carrying Assisted by Claude annotations and automated code reviews generated through Claude Code. Despite the involvement of AI during discovery and patch review, both researchers and OpenWrt maintainers manually validated the reported vulnerabilities and corresponding fixes before publication. OpenWrt recommends that users immediately upgrade to versions 24.10.8 or 25.12.5, update any separately installed software packages, review delegated LuCI permissions, remove unnecessary optional applications, and verify that no public parameterized commands remain enabled in luci app commands. OpenWrt also noted that version 24.10 will remain under security maintenance until its projected end of life in September 2026, after which users are encouraged to migrate to the 25.12 release series.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
