Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root OpenWrt 关键 DHCPv6 漏洞可能导致未认证攻击者以 root 身份运行代码

TL;DR

• A critical stack overflow vulnerability (CVE-2026-53921) in OpenWrt's odhcpd allows unauthenticated remote code execution as root via crafted DHCPv6 REQUEST packets, rated 9.8 on CVSS 3.1 due to lack of stack canaries and ASLR in embedded devices.
• The flaw involves two independent overflow sites in the DHCPv6 request-processing path where crafted IA options exceed a fixed 512-byte stack buffer without sufficient bounds checking.
• OpenWrt 24.10.8 and 25.12.5 release includes fixes for this critical issue along with multiple other pre-authentication weaknesses including out-of-bounds write, use-after-free, memory disclosure, denial of service, stack over-read, neighbour-discovery proxy spoofing, HTTP request-smuggling bugs, and DHCPv6 hostname-injection flaws.
• An AI-assisted audit by Hacker House identified additional command-injection, path-traversal, and XSS weaknesses in optional LuCI components that remain under review and were not included in the 24.10.8 release.
• OpenWrt 24.10 is projected to reach end of life in September 2026, with recommendation to migrate to the 25.12 series before then.

Why It Matters

This vulnerability represents a severe security risk for countless IoT and networking devices running OpenWrt, as it enables complete device compromise without authentication from network-adjacent attackers. The combination of root privileges, lack of common mitigations like ASLR and stack canaries in embedded systems, and public proof-of-concept code makes this particularly dangerous for practitioners managing large-scale deployments of OpenWrt-based infrastructure. The simultaneous discovery of multiple vulnerabilities through automated auditing highlights the importance of continuous security testing in open-source firmware projects.

Technical Details

• CVE-2026-53921 affects odhcpd versions containing dhcpv6_ia_handle_IAs() and build_ia() functions, specifically master at commit e432dd6 and all earlier vulnerable versions
• Two distinct overflow paths exist: one triggered by five IA_NA bindings created with an earlier SOLICIT message, another by a single crafted DHCPv6 REQUEST packet sent to UDP port 547
• Both overflow sites occur when crafted IA options leave insufficient space in a fixed 512-byte stack buffer before code appends additional reply data without adequate bounds checking
• The fix implemented checks remaining response-buffer capacity before appending affected data to prevent buffer overflows
• Additional vulnerabilities addressed include CVE-2026-62948 (DHCPv6 hostname-injection causing stored XSS in LuCI leases page) and CVE-2026-62947 (path traversal in cgi-io requiring authenticated session with specific permissions)
• Separate LuCI vulnerabilities identified by Hacker House include directory traversal in luci-app-bmx7, stored XSS in luci-app-olsr, and command injection in luci-app-commands, with some findings potentially executable without authentication under specific configurations

Industry Insight

Security teams managing OpenWrt deployments should prioritize immediate upgrade to version 24.10.8 or 25.12.5, particularly for devices exposed to networks where DHCPv6 services are accessible, given the critical severity and availability of exploit code. Organizations should implement network segmentation to limit access to DHCPv6 services (UDP port 547) from untrusted networks until upgrades can be completed. The discovery process demonstrates the value of combining traditional security audits with AI-assisted analysis, suggesting that organizations should consider integrating automated vulnerability scanning tools into their regular firmware update cycles to identify similar issues proactively before they become critical vulnerabilities.

TL;DR

• OpenWrt 24.10.8/25.12.5 修复了高危 DHCPv6 栈溢出漏洞（CVE-2026-53921），未认证攻击者可利用该漏洞在默认无 ASLR/栈保护的嵌入式设备上以 Root 权限执行任意代码。
• 本次更新还修补了 odhcpd、uHTTPd 及 cgi-io 中的多个远程可触发的内存破坏与注入缺陷，包括 HTTP 请求走私和存储型 XSS。
• Hacker House 通过 AI 辅助审计发现 LuCI 组件存在命令注入、路径遍历等 7 项安全问题，相关补丁仍在审查中，部分为预授权可利用。
• OpenWrt 24.10 系列将于 2026 年 9 月终止支持，建议用户尽快迁移至 25.12 版本并单独更新第三方包。
• 截至 7 月 28 日，该漏洞尚未被野外利用，也未列入 CISA KEV 目录，但 PoC 代码已公开，风险紧迫性高。

为什么值得看

此事件凸显了嵌入式 Linux 发行版在网络服务默认开启配置下的严重安全暴露面，尤其当关键守护进程（如 odhcpd）以 Root 运行时且缺乏现代防护机制（ASLR/Canaries），极易导致设备沦陷。同时，AI 辅助审计在快速发现复杂逻辑缺陷方面的价值得到验证，推动开源项目加强自动化安全测试流程。

技术解析

• 核心漏洞 CVE-2026-53921：位于 odhcpd 的 dhcpv6_ia_handle_IAs() 和 build_ia() 函数中，构造的 DHCPv6 REQUEST 报文含异常 IA_NA 选项，使固定 512 字节栈缓冲区溢出；触发条件为 UDP 547 端口接收未认证请求， exploit 成功率因目标设备缺少内存保护而极高。
• 修复方案：通过在写入前检查剩余响应缓冲区容量进行边界校验，避免越界写；同时升级至 24.10.8 或 25.12.5 版本获取完整补丁集。
• 关联缺陷：同一版本还修复了 odhcpd 中的 use-after-free、DoS、邻居发现代理欺骗等问题；uHTTPd 存在三个 HTTP 请求 smuggling 漏洞；cgi-io 的路径遍历漏洞（CVE-2026-62947）需认证权限但可读取任意 root 可读文件。
• LuCI 侧边问题：Hacker House 审计发现 luci-app-bmx7 存在目录遍历、luci-app-olsr 有存储 XSS、luci-app-commands 含命令注入（部分无需认证），当前 Pull Request #8878 包含九次提交，涵盖报告问题及 OpenWrt 自发现的额外隐患。
• 开发状态：OpenWrt 24.10 进入安全维护期，EOL 预计 2026 年 9 月；独立安装的软件包需手动更新；LuCI 补丁尚未合并，存在延迟风险。

行业启示

• 嵌入式设备厂商应默认关闭非必要网络服务（尤其是 DHCPv6 等底层协议），并为关键进程启用栈保护、ASLR 等编译时/运行时防御措施，降低 RCE 成功率。
• 开源项目需将 AI 驱动的静态/动态分析纳入常规 CI/CD 流程，特别是在处理用户输入和网络协议的模块中，提前识别类似缓冲区溢出或注入类缺陷。
• 对于依赖 OpenWrt 的物联网部署者，必须建立严格的固件升级策略，优先关注官方安全公告，并对 LuCI 等 Web 界面组件实施最小权限原则，限制管理员访问范围。