Loading story…
OpenWrt released 24.10.8 and corresponding 25.12.5 updates to fix a critical remote code execution flaw in odhcpd, tracked as CVE-2026-53921, that could let an unauthenticated attacker send a crafted DHCPv6 REQUEST to UDP port 547 and potentially execute code as root on affected routers. The project said the service release addresses numerous security issues, including several remotely triggerable flaws in default-enabled network services, and strongly recommended that users upgrade. OpenWrt also updated its 24.10 stable release pages to identify 24.10.8 as the latest release in the series.
Beyond the DHCPv6 bug, the release includes fixes across the Linux kernel, dnsmasq, uhttpd, rpcd, cgi-io, LuCI components, umdns, ead, hostapd/wpa_supplicant, dropbear, musl libc, and OpenSSL. Reported issues addressed include three HTTP request-smuggling bugs in uhttpd, a DHCPv6 hostname-injection flaw leading to stored XSS in LuCI, and a path traversal issue in cgi-io tracked as CVE-2026-62947; OpenWrt noted that optional package fixes require separate package updates. The project also said the 24.10 branch is now in security-maintenance mode with end of life projected for September 2026, and advised users to migrate to OpenWrt 25.12 before then.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A report said OpenWrt 24.10.8 and corresponding 25.12.5 updates fixed CVE-2026-53921, a critical odhcpd DHCPv6 stack overflow that could allow unauthenticated remote code execution as root. It also highlighted other fixes in odhcpd, uhttpd, LuCI, and cgi-io, while noting some additional LuCI fixes were still under review.
An article described CVE-2026-31431, nicknamed "Copy Fail," as a critical Linux kernel local privilege-escalation vulnerability in the algif_aead module that could let an unprivileged user gain root without persistent disk changes. The write-up also warned of possible container-to-host compromise and recommended patching or disabling the module if unused.
A revision to the OpenWrt 24.10.8 release notes changed the page title date from "25. July 2026" to "26th July 2026". The diff reflects a documentation update rather than a new vulnerability disclosure or exploitation event.
The OpenWrt 24.10 release page was updated to identify v24.10.8 as the latest release in the series, replacing v24.10.7. The page states that version 24.10.8 was released on 26 July 2026.
OpenWrt released stable version 24.10.8 and said it fixes many security issues, including several remotely triggerable flaws in default-enabled network services. The project strongly recommended upgrading and noted the 24.10 series had entered security-maintenance mode.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourceinfosecwriteups.com
Open sourceopenwrt.org
Open sourceopenwrt.org
Open sourcefirst.org
Open sourceopenwrt.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenWrt released **v25.12.5** with urgent fixes for multiple security issues in default-enabled network services, including **CVE-2026-62948**, a flaw that lets an unauthenticated DHCPv6 client inject forged lines into `/tmp/odhcpd.leases` through the FQDN hostname option. Those injected entries can later be rendered as live HTML in the **LuCI** “Active DHCPv6 Leases” page, creating a stored cross-site scripting path against administrators who view the interface. The vulnerability affects OpenWrt versions prior to **25.12.5** and carries a high-impact `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H` rating. The service release also patches additional vulnerabilities across **odhcpd**, **uhttpd**, **LuCI**, **cgi-io**, and **ead**, alongside updates to the Linux kernel, **OpenSSL**, **musl libc**, and **dropbear**. OpenWrt said several of the corrected issues could enable remote code execution, request smuggling, stored XSS, privilege escalation, arbitrary file read, memory corruption, or denial of service, and strongly urged users to upgrade. Advisory metadata for **CVE-2026-62948** indicates proof-of-concept exploitation exists, although exploitation is not considered automatable.
Jul 15, 2026
CERT/CC and the dnsmasq maintainer disclosed six vulnerabilities in **dnsmasq** that affect most supported, non-legacy versions and can lead to DNS cache poisoning, denial of service, information disclosure, security-control bypass, heap manipulation, and local privilege escalation. The issues are tracked as `CVE-2026-2291`, `CVE-2026-4890`, `CVE-2026-4891`, `CVE-2026-4892`, `CVE-2026-4893`, and `CVE-2026-5172`, and stem from flaws in memory safety, input validation, DNSSEC handling, DHCPv6, and DNS parsing. Several attack paths are remote via crafted DNS packets or malformed DNS responses, while `CVE-2026-4892` is a heap-based out-of-bounds write in DHCPv6 that can let a local attacker execute arbitrary code as root with a crafted packet. Maintainer Simon Kelley released **dnsmasq `2.92rel2`** with backported fixes for the stable branch and indicated the fixes are incorporated into **version `2.93`**, which CERT/CC lists as fixed. Vendor remediation followed quickly, including a Debian security update (`DSA 6264-1`), and additional vendors were expected to publish patched packages. The disclosure drew attention because dnsmasq is widely deployed in routers, Linux systems, and embedded environments, making prompt patching important wherever the service is exposed to untrusted DNS or local network traffic.
Jul 20, 2026
Public disclosures highlighted multiple high-severity vulnerabilities across industrial control systems, open-source software, and consumer networking gear, with several issues enabling **unauthenticated remote compromise**. Johnson Controls disclosed **CVE-2025-26385** (CVSS 10.0), a critical SQL injection affecting multiple building/ICS management products (including *ADS/ADX, LCS8500, NAE8500, SCT, CCT*) that can allow remote, unauthenticated attackers to execute arbitrary SQL to alter/delete/exfiltrate data; CISA guidance emphasized isolating control system networks from the internet, segmentation, and controlled remote access (e.g., VPNs). Additional unauthenticated remote issues include **CVE-2026-25069** in *SunFounder Pironman Dashboard* (path traversal in log API endpoints enabling arbitrary file read/deletion) and **CVE-2025-51958** in the *DokuWiki* `runcommand` plugin (unauthenticated command execution via `lib/plugins/runcommand/postaction.php`). Other disclosures include developer-tooling and application-layer injection flaws and multiple router memory-corruption bugs with public exploit references. *Orval* fixed **CVE-2026-25141**, a code-injection issue where incomplete escaping can be bypassed using **JSFuck**-style payloads, and *Cybersecurity AI (CAI)* addressed **CVE-2026-25130**, where `subprocess.Popen(..., shell=True)` enables argument/command injection leading to RCE (notably via the `find_file()` tool). Data-layer issues include **CVE-2025-69662** in *geopandas* (`to_postgis()` SQL injection) and **CVE-2026-24854** in *ChurchCRM* (authenticated SQL injection via `PerID` in `/PaddleNumEditor.php`, patched in 6.7.2), while **CVE-2025-36384** affects *IBM Db2 for Windows* (local privilege escalation via unquoted search path). SOHO router flaws **CVE-2026-1686** (*Totolink A3600R*) and **CVE-2026-1637** (*Tenda AC21*) describe remotely reachable buffer/stack overflows with publicly available exploit material, increasing the likelihood of opportunistic exploitation where exposed management interfaces exist.
Jun 29, 2026