OpenWrt has released firmware version 24.10.8 to address a critical stack buffer overflow vulnerability in its DHCPv6 service, alongside fixes for several other remotely exploitable flaws in default-enabled network services. The primary vulnerability, designated CVE-2026-53921, carries a severe CVSS 3.1 score of 9.8 and permits an unauthenticated attacker to execute arbitrary code with root privileges by reaching the DHCPv6 server.
The flaw is located within the odhcpd daemon. An attacker can compromise a vulnerable device by sending a single, specially crafted DHCPv6 packet to UDP port 547, which triggers a stack buffer overflow. This attack requires no authentication or prior access. Given that many OpenWrt installations—commonly found on home routers and small-office devices—enable IPv6 and the DHCPv6 server by default, the potential attack surface is extensive.
Beyond patching this specific overflow, the 24.10.8 release bundles corrections for a range of other remotely triggerable issues affecting standard network services. Consequently, applying the complete update is strongly recommended over implementing partial workarounds. Users and administrators are urged to upgrade all affected systems promptly.
For situations where an immediate firmware update is not feasible, a temporary mitigation involves disabling IPv6 entirely or deactivating the DHCPv6 server if it is not essential for operations. This reduces immediate exposure but is not a substitute for full patching and should only be considered a short-term measure.
This incident highlights a persistent trade-off in open-source embedded systems: default convenience services can transform into high-risk attack vectors when a memory-safety vulnerability emerges. As a core component for IPv6 address management, a compromised odhcpd daemon can lead to complete device takeover, enabling potential traffic interception, persistent backdoors, or further network penetration.
IT professionals and community members using OpenWrt should audit all deployed devices, prioritize upgrading to version 24.10.8, and assess the operational necessity of DHCPv6 and other infrequently utilized services. While upgrades are underway, enhanced network segmentation and monitoring for anomalous traffic on port 547 can offer additional protection.
This disclosure underscores that even well-established, trusted firmware requires ongoing vigilance regarding its default configuration and attack surface. Immediate patching remains the most effective security response.
OpenWrt已發布韌體版本24.10.8，以修補其DHCPv6服務中一個嚴重的堆疊緩衝區溢位漏洞，同時修正多項在預設啟用的網絡服務中發現的其他可遠端利用缺陷。首要漏洞被編號為CVE-2026-53921，CVSS 3.1評分高達9.8，攻擊者可透過連線至DHCPv6服務器，在未經認證的情況下以root權限執行任意代碼。
該漏洞位於odhcpd守護進程內。攻擊者可透過向UDP端口547發送一個特製的DHCPv6數據包來入侵易受攻擊的設備，從而觸發堆疊緩衝區溢位。此攻擊無需認證或事前存取權限。考慮到許多OpenWrt安裝——常見於家用路由器和小型辦公室設備——預設啟用了IPv6及DHCPv6服務器，潛在的攻擊面相當廣泛。
除了修補此特定溢位漏洞外，24.10.8版本還包含一系列影響標準網絡服務、可由遠端觸發的其他問題修正。因此，強烈建議套用完整更新，而非僅實施部分暫時性措施。敦促用戶及管理員盡快升級所有受影響系統。
若無法立即進行韌體更新，暫時性緩解方法包括完全停用IPv6，或在操作非必需的情況下停用DHCPv6服務器。這能減少當前暴露風險，但並不能取代完整修補，僅應視為短期措施。
此事件突顯了開源嵌入式系統中一個長期存在的權衡：當出現記憶體安全漏洞時，預設的便利服務可能轉變為高風險的攻擊向量。作為IPv6地址管理的核心組件，被入侵的odhcpd守護進程可能導致設備完全被接管，從而實現流量攔截、持久性後門或進一步網絡滲透。
使用OpenWrt的IT專業人士及社區成員應審核所有已部署設備，優先升級至版本24.10.8，並評估DHCPv6及其他不常用服務的操作必要性。在升級進行期間，加強網絡分區及監控端口547的異常流量可提供額外保護。
此披露強調，即使是成熟且受信任的韌體，亦需對其預設配置及攻擊面保持持續警惕。立即修補仍是最有效的安全回應措施。