OpenWrt Patches Critical DHCPv6 RCE in Default Server

OpenWrt 24.10.8 is out. The critical fix is a stack buffer overflow in odhcpd — the DHCPv6 server that ships enabled by default on OpenWrt installations — that lets an unauthenticated attacker send a crafted DHCPv6 packet and overwrite stack memory. Code execution as root on the device. OpenWrt’s own advisory rates it 9.8 on CVSS 3.1 critical. The same release also closes a wider set of remotely triggerable flaws in other default-enabled network services.

What changed

• odhcpd (DHCPv6 server, on by default) — a crafted DHCPv6 message from an unauthenticated attacker can overflow a stack buffer in the server process. On a successful hit: root code execution on the device.
• CVSS 9.8 critical. Network-adjacent. No credentials required.
• Additional remotely triggerable flaws in other default network services are patched in the same 24.10.8 batch. Full details in the OpenWrt GitHub security advisory.

What to do

1. Update to OpenWrt 24.10.8. Do it via the web UI under System → Firmware Upgrade, or via LuCI or opkg if you’re managing devices remotely. This is the patched release for both the current and LTS branches.
2. If you cannot update immediately: Disabling odhcpd removes the attack surface for the critical flaw, at the cost of DHCPv6 address assignment on IPv6 networks. Whether that trade-off is acceptable depends on your IPv6 deployment. If you’re not using IPv6, disabling it costs you nothing.
3. Check your exposure: The DHCPv6 server is reachable by any host on the same L2 segment. That usually means your LAN, but misconfigured WAN-facing interfaces or bridged networks can widen that surface. Check what’s reachable on the affected port.

Priority call

CVSS 9.8 with no authentication required and default-enabled attack surface. Router firmware gets patched far less reliably than server software in most environments — that’s the honest timeline on this class of device. If you’re running OpenWrt anywhere — home lab, branch office router, embedded deployment — update now. This is not a “next maintenance window” situation.

Source: The Hacker News.