External risk intelligence

OpenWrt odhcpd DHCPv6 Stack Buffer Overflow leading to Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-53921

The vulnerability exists in odhcpd, a network service used by OpenWrt for DHCP and router advertisement. While these services are essential in network deployments, they are typically designed to operate within a local area network (LAN) segment rather than being directly exposed to the public internet. Therefore, while reachable from the network, public-facing exposure is not the standard deployment pattern.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the odhcpd service, which manages network addressing for OpenWrt devices. This issue could allow an unauthenticated attacker on the network to potentially execute code on affected devices. The main concern is confirming relevance and exposure within our environment.

Network service flaw allows code execution.
Critical flaw affects OpenWrt network management.
Verify if OpenWrt devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted network packet to a vulnerable system. This packet targets the DHCPv6 service, which is responsible for assigning network configurations. If the packet contains enough specific options, it can trigger a buffer overflow within the service, potentially leading to code execution.

Unauthenticated network access required.
Specialized DHCPv6 packet triggers overflow.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A flaw in how odhcpd handles DHCPv6 requests could allow an attacker to execute arbitrary code when the service is running. This could occur when a device using OpenWrt's odhcpd receives a specially crafted, unauthenticated UDP packet over the network. The vulnerability could allow for the compromise of the affected system.

System configuration and network control.
Unauthenticated network packet.
Remote code execution possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in odhcpd, a critical DHCP and router advertisement service for OpenWrt, impacts devices reachable from the network. Infrastructure or platform teams responsible for network services should prioritize identifying all instances of odhcpd, assessing their exposure, and confirming business criticality. Once this inventory and risk assessment are complete, a plan for remediation, likely involving coordinated updates during maintenance windows, can be executed.

Network/Platform teams own this issue.
Verify odhcpd instances and network exposure.
Plan coordinated updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is odhcpd and how is it used in OpenWrt?

odhcpd is the primary server component in OpenWrt responsible for managing dynamic network configurations. It handles DHCPv4 and DHCPv6 requests, as well as router advertisements, which allows devices on a network to automatically receive IP addresses and connectivity settings. Because it runs with root-level privileges to perform these system-wide networking tasks, it acts as a fundamental service for any OpenWrt-based router or gateway.

What does CWE-121 mean for CVE-2026-53921?

CWE-121 refers to a stack-based buffer overflow. In the context of CVE-2026-53921, this means the software attempts to store more data in a reserved memory area (the stack) than it can hold. Because the DHCPv6 response handler fails to properly check the size of the data being written, it overwrites adjacent memory. This memory corruption can allow an attacker to bypass normal program execution and run their own malicious instructions on the device.

How is this DHCPv6 vulnerability triggered?

An attacker triggers the vulnerability by sending a specially crafted, unauthenticated UDP packet to the target system. The overflow occurs specifically when a DHCPv6 REQUEST packet contains an excessive number of Identity Association (IA) options, forcing the service to write past its fixed 512-byte buffer limit. Normal, valid DHCPv6 traffic that does not overload these specific reply buffers does not trigger the flaw.

Do I need to worry if my OpenWrt device is internal?

Yes. While Halo Surface Signal notes that odhcpd is typically used within a local area network (LAN) and is not usually exposed directly to the public internet, the vulnerability is reachable from the network segment where the device is active. An attacker who has gained a foothold on any device within your local network or via a compromised guest network can reach the service and attempt to exploit it.

How do I address this CVE-2026-53921 flaw?

The vulnerability is addressed by upgrading your OpenWrt software to version 25.12 or later, which contains the necessary patches for the affected DHCPv6 handler. You should begin by inventorying all devices running odhcpd to assess their role and network placement. Once identified, plan to apply the update through your standard maintenance processes to ensure the service is no longer susceptible to these memory overflow issues.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.