OpenWrt (versions prior to 24.10.8 and 25.12.5)
OpenWrt is an open-source operating system that replaces the factory firmware on home and small-business routers, giving users more control over their network hardware.
Root Cause
The odhcpd component processes incoming DHCPv6 requests into a fixed 512-byte stack buffer without adequately checking whether the incoming data fits before appending reply information. Because odhcpd runs as root, and because most embedded routers lack stack canaries (small memory guards that detect overflow attempts) or ASLR (address space layout randomisation, which randomises memory locations to hinder exploit code), an overflow reliably translates into remote code execution rather than just a crash.
Attack Vector
An attacker sends a crafted DHCPv6 REQUEST to UDP port 547. No authentication is required. The malformed packet overflows the stack buffer inside odhcpd, allowing the attacker to redirect execution and run arbitrary commands as root. Public proof-of-concept code is available in the advisory.
Detection Notes
Check odhcpd logs for malformed or unexpected DHCPv6 REQUEST messages on port 547. Look for unexpected root-level processes spawned by odhcpd. Monitor for unusual outbound connections from your router immediately after DHCPv6 activity.
Recommended Actions
- Update to OpenWrt 24.10.8 or 25.12.5 using the OpenWrt Firmware Selector.
- If you cannot patch immediately, consider disabling DHCPv6 on interfaces not actively using IPv6.
- Begin planning migration to the 25.12 series before the 24.10 branch reaches end of life in September 2026.