Loading vulnerability…
CVE-2026-53921 is a critical stack-based buffer overflow in OpenWrt's odhcpd service, specifically in the DHCPv6 Identity Association reply serialization path. The flaw is described as involving a fixed 512-byte stack buffer that can be overrun when odhcpd processes crafted DHCPv6 REQUEST packets and appends reply data without sufficient remaining-capacity checks. Available reporting indicates the vulnerable code path is associated with older odhcpd versions containing the DHCPv6 handling functions dhcpv6_ia_handle_IAs() and build_ia(). Under attacker-controlled IA option layouts, odhcpd can write beyond the allocated stack buffer while constructing a DHCPv6 reply. Because odhcpd runs with root privileges by default on affected OpenWrt systems, successful exploitation can result in severe compromise.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Repository contains a Python-based exploit and a separate Python verifier for CVE-2026-53921, a claimed stack buffer overflow in OpenWrt's odhcpd DHCPv6 handling. Structure is minimal: README with vulnerability narrative and usage context, exploit.py as the main offensive component, verifier.py as a non-exploit checker, and requirements.txt listing scapy/requests/PySocks/paramiko. exploit.py is the primary entry point and is clearly intended for active exploitation rather than mere detection. It requires root, uses Scapy to craft/send IPv6 DHCPv6 packets, supports single-target or list-based targeting, multithreaded scanning, architecture handling, optional SOCKS proxying, and listener management. The visible code includes hardcoded MIPS shellcode builders for reverse and bind shells and architecture-specific return addresses (generic, ar71xx, ramips), indicating the exploit is tailored toward common OpenWrt router architectures. Based on the exposed imports, argument handling, and control flow, the script can scan for DHCPv6 responsiveness, detect/choose architecture, generate payloads, and attempt exploitation with options such as vector selection, offset tuning, encoding, persistence, and log clearing. verifier.py is a companion detection utility. It does not exploit the target; instead it checks whether DHCPv6 responds on the local link using multicast ff02::1:2 and UDP 546->547, then attempts version inference via HTTP and SSH banner checks. It flags OpenWrt versions before 24.10.8 and 25.12.5 as vulnerable. Fingerprintable targets/endpoints are primarily network-facing: DHCPv6 UDP/547, DHCPv6 multicast ff02::1:2, SSH TCP/22, and HTTP on the target IPv6 host. The exploit is aimed at unauthenticated remote network exploitation over IPv6 against vulnerable OpenWrt/odhcpd instances, with the intended outcome of root-level shell access.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Критическая уязвимость удаленного выполнения кода в компоненте OpenWrt odhcpd (DHCPv6-сервер), вызванная переполнением буфера при обработке специально сформированного DHCPv6 REQUEST, что позволяет неаутентифицированному атакующему выполнить код с правами root.
A critical unauthenticated stack buffer overflow in OpenWrt's odhcpd DHCPv6 service that can be triggered remotely via a crafted DHCPv6 REQUEST and could lead to code execution on devices lacking protections like stack canaries and ASLR.
A critical stack-based buffer overflow in OpenWrt's odhcpd DHCPv6 request-processing path that can be triggered remotely without authentication and may realistically lead to code execution as root on embedded devices.
A critical stack buffer overflow in OpenWrt odhcpd's DHCPv6 IA reply serialization that can be triggered by a network-adjacent attacker using crafted DHCPv6 REQUEST packets.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.