CVE-2026-53920: fallo de gravedad alta en openwrt odhcpd
odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.5%
probabilidad de explotación
0.5%top 58% de las CVE
explotación observada
noninguna fuente lo reporta
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
openwrt · odhcpdCVEs relacionadas — openwrt odhcpd
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-53921CRITICALodhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)EPSS 0.9%CVE-2026-53918HIGHodhcpd DHCPv6 IA dangling first pointer use-after-freeEPSS 0.7%CVE-2026-55606MEDIUModhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp()EPSS 0.5%CVE-2026-53922MEDIUModhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated)EPSS 0.3%