Security · 18h ago
Critical OpenWrt Bug Lets Attackers Execute Code Remotely via DHCPv6
OpenWrt released version 24.10.8 to patch a critical DHCPv6 stack overflow, CVE-2026-53921, rated 9.8 on CVSS. The flaw allows unauthenticated attackers to execute arbitrary code as root by sending a crafted DHCPv6 packet. The update also fixes other remotely triggerable vulnerabilities in default-enabled network services.
Meridian48 take
While the patch is available, the severity underscores the risk of leaving default services exposed on embedded devices, especially in edge deployments.
Read the full reporting
Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root →
The Hacker News
openwrtdhcpv6-flaw