OpenWrt Ships Emergency Fix for Critical Router Flaw That Hands Attackers Full Control

Key points

• OpenWrt released version 24.10.8 to fix a critical flaw tracked as CVE-2026-53921, rated 9.8 out of 10 for severity.
• The bug sits in odhcpd, a network service that OpenWrt turns on by default on many routers.
• An attacker who can reach the router over the network can run their own code as the top-level administrator, without needing a password.
• Home users, small offices and internet service providers relying on OpenWrt firmware are all in scope.
• Update to 24.10.8 now; there is no reliable workaround short of disabling the affected service.

OpenWrt, the open-source firmware that runs on millions of home and business routers, has pushed out an emergency update to close a critical hole that lets attackers seize a device without so much as a login prompt.

The fixed release is 24.10.8. The flaw it patches, CVE-2026-53921, scores 9.8 on the industry severity scale of 10. That is about as bad as router bugs get.

What is actually broken?

The bug lives in odhcpd, the small program OpenWrt uses to hand out network addresses to devices on your Wi-Fi. Specifically, it handles DHCPv6, the newer version of the system that gives every phone, laptop and smart bulb an address on the network.

OpenWrt's own advisory describes a stack buffer overflow, meaning the program does not properly check the size of an incoming message and can be tricked into writing past the end of its memory. An attacker who crafts a malicious DHCPv6 packet can use that mistake to run their own instructions on the router, as root, which is the highest level of access a Linux device has.

No username. No password. Just a packet.

Who is at risk?

Anyone running OpenWrt on a router where odhcpd is exposed to an untrusted network. That is the default on a large share of OpenWrt installs, which is what makes this one nasty.

Home users typically only expose the service on their internal network, which limits the danger to someone already on your Wi-Fi. Small offices, community mesh networks and internet service providers that push OpenWrt-based firmware to customers are in a worse spot: if the service faces a segment shared with strangers, a single packet is enough.

The numbers that matter

How did this get through?

DHCPv6 code is notoriously fiddly. Packets carry nested options, variable lengths and optional fields, and a single missed size check on the way in is enough to open a hole like this one. As reporting by The Hacker News notes, the same 24.10.8 release cleans up a broader set of remotely triggerable bugs in services that OpenWrt enables out of the box, suggesting the project's maintainers went looking once they found the first one.

That is healthy behaviour. It also means administrators should not treat 24.10.8 as an optional bump.

What should users and admins do?

Update. If you run OpenWrt yourself, install 24.10.8 from the official download page and reboot. If your router came with a vendor's fork of OpenWrt, check whether that vendor has picked up the fix; many downstream builds lag by weeks.

If you cannot patch immediately, restrict which interfaces odhcpd listens on so it is not exposed to any network you do not fully trust. Turning DHCPv6 off entirely is an option on networks that only use the older IPv4 protocol, though most modern setups will notice the loss.

Regulators have not weighed in yet, and given this is a firmware flaw rather than a data breach, formal breach-notification rules under the FTC, ICO or OAIC are unlikely to apply directly. That does not make it less urgent. A router owned at root level is a router that can quietly read, redirect or block everything that passes through it.