CVE-2026-53921: OpenWrt DHCPv6 — Remote Root Code Execution (July 2026)

CVE-2026-53921 — OpenWrt DHCPv6

CVE-2026-53921 is a critical stack overflow vulnerability in OpenWrt's DHCPv6 implementation. It allows unauthenticated attackers with network access to the DHCPv6 service to execute arbitrary code as root. No exploitation in the wild has been observed as of July 2026, but the risk is severe due to the potential for full device takeover.

Attack Vector

Attackers exploit this flaw by sending specially crafted DHCPv6 packets to a vulnerable OpenWrt device. No authentication is required; only network access to the DHCPv6 server is needed. The overflow occurs in the DHCPv6 stack, enabling attackers to overwrite memory and execute code with root privileges. Additional vulnerabilities (CVE-2026-62948, CVE-2026-62947) in LuCI components allow command injection, path traversal, and stored XSS, but require different access vectors.

Who Is at Risk

All organizations and individuals running unpatched OpenWrt devices with DHCPv6 enabled are at risk. This includes routers, gateways, and embedded systems using OpenWrt firmware globally. The vulnerabilities affect OpenWrt deployments where the DHCPv6 service is exposed to untrusted networks, including public-facing or bridged environments.

Patch & Mitigate

• Patch: Apply the latest OpenWrt security updates released July 2026. Update to the patched firmware version immediately.
• Workaround: If patching is not immediately possible, disable the DHCPv6 service or restrict network access to trusted hosts only.
• Detect: Monitor logs for anomalous DHCPv6 traffic, unexpected process crashes, or signs of privilege escalation. Review for unusual activity in LuCI web interface logs.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers gain initial access via exposed DHCPv6 services.
• TA0008 — Lateral Movement: Compromised routers can be leveraged to move laterally within the network.
• TA0005 — Defense Evasion: Root access enables attackers to disable security controls and hide activity.

Source: https://thehackernews.com/2026/07/critical-openwrt-dhcpv6-flaw-could-let.html