OpenWrt odhcpd: Stack buffer overflow in DHCPv6 IA reply handling

Summary

odhcpd, the DHCPv6, DHCPv4 and router advertisement server used by OpenWrt, contains two stack buffer overflows in the handling of DHCPv6 IA replies. A single unauthenticated UDP packet carrying many IA options can write past a fixed 512-byte stack buffer. Because odhcpd runs as root and embedded targets often lack stack canaries and ASLR, remote code execution as root is realistic. Public proof-of-concept code exists, but no confirmed in-the-wild exploitation was known at the time of the research notes.

Affected

• OpenWrt odhcpd versions before 25.12 (CNA range)
• OpenWrt releases older than 24.10.8 and 25.12.5 should be treated as vulnerable, as the 24.10.x branch was fixed separately
• odhcpd is enabled by default on OpenWrt
• Exposure: UDP port 547 (DHCPv6)

Fixed in

• OpenWrt 25.12.5 and later
• OpenWrt 24.10.8 and later
• Upstream commits in 25.12 (d168c27, 6634b7a, 2a42d34) and master (d329a15, 0320032, 03dacc2)
• No vendor-stated fixed odhcpd package version was found; check the installed odhcpd package version against the release notes.

Workaround

• Upgrade is the primary remedy.
• If upgrading is not possible immediately, disable odhcpd if IPv6 is not used (community recommendation, not from the vendor; verify that IPv6 still works).
• Block UDP 547 on the WAN side and on untrusted segments.

Exploitation

• Public proof-of-concept code exists for both overflow paths.
• No confirmed in-the-wild exploitation as of late July 2026.
• Not marked as known exploited in the sources reviewed; the CISA KEV catalogue was not checked directly.
• CISA SSVC: exploitation poc, automatable yes, technical impact total.

Our recommendation

• Inventory all OpenWrt devices and their release and odhcpd package versions.
• Upgrade to OpenWrt 24.10.8, 25.12.5 or later.
• Confirm that UDP 547 is not reachable from the WAN or from untrusted or guest segments.
• Re-check the GHSA advisory and the CISA KEV catalogue in the coming weeks.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (2 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  0xBlackash/CVE-2026-53921 · tc4dy/CVE-2026-53921-PoC-Exploit

Research sources

• GitHub Security Advisory GHSA-7fwx-hhrg-3496 github.com
• Commit 0320032 (odhcpd fix out of bounds write) github.com
• Commit 03dacc2 (Reconfigure Accept Auth option write offset) github.com
• OpenWrt 25.12.5 service release announcement forum.openwrt.org
• The Hacker News: Critical OpenWrt DHCPv6 flaw thehackernews.com
• Strix CVE record CVE-2026-53921 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:42.