A critical OpenWrt flaw, CVE-2026-53921, lets an unauthenticated attacker on the local network run code as root by sending a single crafted DHCPv6 REQUEST to UDP port 547 — patch to OpenWrt 24.10.8 or 25.12.5 now. The bug carries a CVSS score of 9.8 and sits in odhcpd, the DHCPv6 server that ships and runs by default on the world's most widely used open router firmware. Public proof-of-concept code already exists for both overflow paths, and there is no authentication step in front of it.

The vulnerability is a stack buffer overflow in how odhcpd parses an incoming DHCPv6 REQUEST. OpenWrt's advisory describes two independent overflow paths reachable during request processing, and a Python proof-of-concept has been published for each. As of July 28, 2026 there are no confirmed reports of exploitation in the wild — but "no exploitation yet" is a timing statement, not a safety one, especially once working PoC code is circulating.

What makes this bug more dangerous than its CVSS number suggests is the hardware it runs on. OpenWrt and its many downstream forks power millions of consumer routers, travel routers, and embedded gateways, and that class of device routinely ships without the memory-safety mitigations desktop and server operating systems take for granted. As the advisory notes, "embedded hardware commonly lacks stack canaries and address space layout randomization (ASLR), making code execution a realistic outcome on typical devices." Without ASLR, the public PoC becomes largely deterministic — an attacker can redirect execution onto fixed stack offsets instead of building a fragile exploit chain around an info leak.

Is CVE-2026-53921 remotely exploitable from the internet?

Not directly in a default configuration. DHCPv6 (UDP 547) is a link-local service, so the immediate blast radius is anyone already on your LAN, Wi-Fi, or a bridged guest network — a malicious guest, a compromised IoT device, or malware on any machine behind the router. That still matters: a router is the one device that sees all of your traffic, and root on it means silent traffic interception, DNS tampering, and a persistent foothold that survives client reboots. Security teams on Hacker News flagged this as an "update immediately" event precisely because the router is the trust anchor for everything behind it.

Which OpenWrt versions are affected and how do I patch?

Both current branches are affected before their fixed point releases. The clean fix is a full sysupgrade, but if reflashing is risky on a remote or heavily customized device, the odhcpd package can be updated on its own, and disabling the DHCPv6 server closes the hole entirely where IPv6 addressing isn't needed.

Our read

The recurring theme in this class of bug — C-language network daemons parsing attacker-controlled packets — is why we treat "patched upstream" and "verified fixed on the device" as two different facts. Downstream vendors (GL.iNet, Teltonika, ISP-supplied gateways) rebuild OpenWrt on their own schedules, so the population of exposed devices will lag the upstream fix by weeks or months, and asset inventories rarely track which embedded appliance runs a forked firmware. This is the continuous-verification argument in miniature: our own 2025 analysis of CISA KEV data found that 67% of the year's actively-exploited vulnerabilities would have been missed by a once-a-year pentest, because exposure is a moving target between scans. A router flaw with public PoC and a long downstream patch tail is exactly the kind of window that continuous checking closes and annual snapshots miss.

FAQ

Does this affect my home router? If it runs OpenWrt 24.10 or 25.12 (or a vendor firmware forked from them) below the fixed release, yes. Stock firmware from major consumer brands generally isn't OpenWrt-based, but many travel routers, mesh nodes, and prosumer devices are.

Can I be attacked from the public internet? Only if UDP 547 is exposed on the WAN interface, which is not the default. The realistic threat is an attacker or compromised device already on the local network.

Is there a fix if I can't reflash right now? Yes — update just the odhcpd package with opkg, or disable the DHCPv6 server if you don't hand out IPv6 addresses. Confirm your firewall drops UDP 547 inbound on WAN either way.

Has it been exploited? No confirmed in-the-wild exploitation as of July 28, 2026, but public proof-of-concept code exists for both overflow paths, so treat it as imminent.

Sources: The Hacker News · NVD — CVE-2026-53921 · OpenWrt security advisories

Reporting by The Hacker News; CVE and version details per the OpenWrt security advisory and NVD.

Related: Ubuntu snap-confine local root (CVE-2026-8933) · What CVSS misses: EPSS, KEV and patch prioritization