Critical OpenWrt DHCPv6 RCE (CVE-2026-53921) — PoC Public, Patch Out

Wed, 29 Jul 2026 13:07:14 +0000

Engineer — Act: A public PoC exists for this CVSS 9.8 unauthenticated stack overflow in odhcpd, which is enabled by default. Upgrade all OpenWrt devices to 24.10.8 immediately, or disable DHCPv6/odhcpd on devices that don’t need it.
SOC/IR — Plan: With a public PoC now available, exploitation of internet- or LAN-exposed OpenWrt edge devices is imminent. Build detections for anomalous DHCPv6 traffic volumes and unexpected child processes from odhcpd, and queue a sweep of managed OpenWrt-based appliances for signs of prior compromise.
Leader — Skip
Signals: CVE-2026-53921 — CISA KEV: not listed, EPSS n/a, public PoC on GitHub

Network-Devices on CuraSec