OpenWrt: Updates to address some critical security flaws

OpenWrt has released updated firmware versions addressing several critical security vulnerabilities, some of which can be exploited remotely without prior authentication. The open-source router firmware, known for its flexibility and customization options, now includes patches for issues affecting both the 24.10.8 release from last weekend and the 25.12.5 version released earlier this month. These updates address multiple flaws, including those present in services that are typically enabled by default. The most severe vulnerability identified is within the odhcpd DHCP server, which is active by default on many devices running OpenWrt. This flaw allows attackers to trigger a stack overflow when processing DHCPv6 IA responses via a single UDP packet. The lack of Address Space Layout Randomization (ASLR) on embedded platforms makes it easier for malicious code to execute, increasing the risk of exploitation. This vulnerability is assigned the identifier CVE-2026-53921 with a CVSS score of 9.8 and is classified as critical. Another related issue in odhcpd enables unauthenticated DHCPv6 clients to inject manipulated FQDN hostnames into lease files, leading to a stored cross-site scripting (XSS) vulnerability in the LuCI DHCPv6 leases status page, labeled CVE-2026-62948 with a CVSS score of 9.6 and critical risk rating. Additional fixes target the LuCI web interface, resolving further stored XSS vulnerabilities rated as high risk. A patch for the dropbear-SSH component addresses a long-standing vulnerability dating back to 2019. Updated components such as OpenSSL 3.0.21, dnsmasq 2.93, and the Linux kernel 6.6.144 also contribute to closing multiple security gaps. Users running OpenWrt should apply these updated firmware builds to their devices promptly to reduce exposure to potential attacks. Since OpenWrt is often accessible from the internet, timely updates are crucial. The firmwares are designed to minimize attack surfaces and ensure continued secure operation. In March, the OpenWrt 25.12.0 branch introduced a switch to a new package manager, enhancing system management capabilities. Additionally, this version supports more device models than previous releases, expanding compatibility and usability. These changes reflect ongoing efforts to improve both functionality and security within the OpenWrt ecosystem. The updates underscore the importance of regular maintenance and patching in securing network infrastructure. As more users rely on OpenWrt for home and small business networking, staying current with firmware updates becomes essential. The community-driven nature of OpenWrt ensures that security concerns are addressed through collaborative development and rapid response mechanisms. Users are encouraged to monitor official channels for future advisories and to implement best practices for network security.