OpenWrt Ships Emergency Fix for Critical Router Flaw That Hands Attackers Full Control

Key points

• OpenWrt released version 24.10.8 to fix a critical flaw tracked as CVE-2026-53921, rated 9.8 out of 10 for severity.
• The bug sits in odhcpd, a network service that OpenWrt turns on by default on many routers.
• An attacker who can reach the router over the network can run their own code as the top-level administrator, without needing a password.
• Home users, small offices and internet service providers relying on OpenWrt firmware are all in scope.
• Update to 24.10.8 now; there is no reliable workaround short of disabling the affected service.

OpenWrt, the open-source firmware that runs on millions of home and business routers, has pushed out an emergency update to close a critical hole that lets attackers seize a device without a login prompt. It's the kind of flaw that makes everything downstream of the router negotiable.

The fix is version 24.10.8. CVE-2026-53921 scores 9.8 on the ten-point CVSS 3.1 severity scale. That's about as bad as router bugs get.

What is actually broken?

The bug lives in odhcpd, the small program OpenWrt uses to hand out network addresses. Specifically, it handles DHCPv6, the protocol that assigns addresses to every device on your network.

OpenWrt's own advisory describes a stack buffer overflow: the program doesn't properly check the size of an incoming message and can be tricked into writing past the end of its reserved memory. An attacker who crafts a malicious DHCPv6 packet can exploit that mistake to run arbitrary code on the router as root, the highest level of access a Linux device has.

No username. Just a packet.

Who is at risk?

Anyone running OpenWrt where odhcpd is exposed to an untrusted network. That's the default on a large share of installs, which is what makes this one nasty.

Home users typically only expose the service internally, which limits the danger to someone already on your Wi-Fi. Small offices and internet service providers that push OpenWrt-based firmware to customers are in a worse spot: if the service faces a segment shared with strangers, one packet is enough. Our earlier story on Tenda routers from 9 July 2026 showed how persistently vendors lag on exactly this class of unauthenticated remote-access flaw.

The numbers that matter

How did this get through?

DHCPv6 code is notoriously fiddly. Packets carry nested options and variable-length fields, and a single missed size check on the way in is enough. As The Hacker News notes, the same 24.10.8 release addresses a broader set of remotely triggerable bugs in services OpenWrt enables out of the box, suggesting the project's maintainers went looking once they found the first one.

That's healthy behaviour. It also means administrators shouldn't treat 24.10.8 as an optional bump.

What should users and admins do?

Update. Install 24.10.8 from the official download page and reboot. If your router runs a vendor's fork of OpenWrt, check whether that vendor has picked up the fix; downstream builds often lag by weeks.

Patching immediately isn't always possible. In that case, restrict which interfaces odhcpd listens on so it isn't reachable from any network you don't fully control. Disabling DHCPv6 entirely works on networks running only IPv4, though most modern setups will feel the loss.

Formal breach-notification requirements under regulators such as the FTC or ICO are unlikely to apply here, since this is a firmware flaw rather than a data breach. Don't let that lower the urgency. A router compromised at root level can silently read, reroute or drop everything passing through it.

Should you worry?

Yes, if you haven't patched. The attack requires no credentials and no prior foothold on the device. Routers are the kind of target that state-sponsored crews treat as infrastructure worth owning quietly, as we reported in July covering Russian FSB activity against unpatched network gear. Get the update done.