🚨 CVE-2026-53921 - odhcpd

Critical Stack-Based Buffer Overflow in OpenWrt odhcpd

A remote unauthenticated stack-based buffer overflow allowing potential Remote Code Execution (RCE) with root privileges.

📖 Overview

⚡ Description

CVE-2026-53921 is a critical stack-based buffer overflow affecting the OpenWrt DHCPv6 server (odhcpd).

A remote, unauthenticated attacker can send a specially crafted DHCPv6 REQUEST packet to trigger memory corruption, potentially leading to arbitrary code execution with root privileges or a Denial of Service (DoS).

Because odhcpd executes with root privileges, successful exploitation may result in complete device compromise.

🎯 Impact

✓ Remote Code Execution (RCE)
✓ Root Privilege Compromise
✓ Memory Corruption
✓ Device Takeover
✓ Denial of Service (DoS)

🛠 Affected Component

OpenWrt
└── odhcpd
    └── DHCPv6 Server

✅ Fixed Versions

🛡 Mitigation

• Upgrade to a patched OpenWrt release.
• Restrict DHCPv6 exposure to trusted networks.
• Monitor DHCPv6 traffic for anomalies.
• Apply vendor security updates immediately.

📊 Risk Assessment

🔗 References

• OpenWrt Security Advisory
• CVE Record
• National Vulnerability Database (NVD)