CVE-2026-62948Disclosure(openwrt / openwrt)

MEDIUMCVSS 9.6 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch openwrt openwrt systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefiles_write_state6() and statefiles_write_state4() without escaping, allowing newline injection of forged lease lines that LuCI rpcd-mod-luci getDHCPLeases displays through htdocs/luci-static/resources/view/status/include/40_dhcp.js and htdocs/luci-static/resources/luci.js dom.append as live HTML in the Active DHCPv6 Leases admin page. This vulnerability is fixed in 25.12.5.

openwrt CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

https://github.com/openwrt/openwrt/releases/tag/v25.12.5

Weakness type (CWE)

CWE-79CWE-117CWE-150

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

openwrt

Threat summary

Public PoC and exploit tooling are both present
Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Exploit tool or code specified in 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 2 classified signals
Peaked 2d ago at 2 mentions (2026-07-15); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

openwrt

Products

openwrt

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

PoC

125.0%

Patch

125.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-15	2	Disclosure2
2026-07-28	1	PoC1
2026-08-07	1	Patch1

Full discourse4 posts

BT Haberler@BTHaberler69d
Patch
OpenWrt'nin DHCPv6 Açığı İçin Yama Yayınlandı, İki Ek Açık Daha Ortaya Çıktı Daha önce duyurduğumuz OpenWrt DHCPv6 açığı CVE-2026-53921 için resmi yama yayınlandı; ayrıca aynı bileşende iki yeni açık daha tespit edildi! • CVE-2026-53921 (CVSS 9,8), odhcpd bileşeninin dhcpv6_ia_handle_IAs() ve build_ia() fonksiyonlarında bulunan 512 baytlık bir tampon taşması; UDP 547 portuna özel hazırlanmış bir DHCPv6 REQUEST paketi göndererek root ayrıcalıklarıyla çalışan bileşende tetiklenebiliyor. • Aynı pakette CVE-2026-62948 (DHCPv6 hostname enjeksiyonu) ve CVE-2026-62947 (path traversal) adlı iki ek açık da kapatıldı. • Birçok yönlendiricide stack koruması ve ASLR bulunmadığından, bu açığın istismarı özellikle gerçekçi kabul ediliyor; kullanıcıların OpenWrt 24.10.8 veya 25.12.5 sürümüne güncelleme yapması gerekiyor. CVE'nin orijinal keşfi yapay zeka destekli bir kod denetiminden gelmişti, şimdi gerçek dünya istismar potansiyeli netleşen bu açık için güncelleme yapmayan yönlendiriciler ciddi risk altında. #SiberGüvenlik #OpenWrt #RCE
Post summary
An official patch for CVE‑2026‑53921 has been released, along with fixes for two additional CVEs; routers without stack protection or ASLR face realistic exploitation risk and should update to the latest OpenWrt release.
0000092
38 followersView on X
SecureChap@SecureChap78d
PoC
A single DHCPv6 REQUEST to UDP 547 yields root on OpenWrt routers. CVE-2026-53921 carries a 9.8 CVSS score. The flaw sits in odhcpd, the DHCPv6 daemon enabled by default and running as root. In dhcpv6-ia.c a 512-byte stack buffer named pdbuf receives the IA reply. build_ia() checks only for 16 bytes of space before writing a 22-byte status option. dhcpv6_ia_handle_IAs() writes 36 bytes for RECONF_ACCEPT plus the auth path with no length check at all. Both sites overflow the same buffer. Most embedded targets lack stack canaries and ASLR, so the overwrite produces reliable code execution rather than a crash. Public Python PoCs of roughly 120 lines each configure odhcpd via UCI, start the daemon, and trigger either site. The same 24.10.8 release also fixed CVE-2026-62948, a DHCPv6 hostname injection that produced stored XSS in LuCI. No in-the-wild exploitation has been reported. A stack buffer sized for convenience instead of the protocol becomes the entire attack surface.
Post summary
The post discloses a severe stack buffer overflow in OpenWrt’s odhcpd, provides public Python PoCs that exploit it, confirms no current in‑the‑wild attacks, and offers detailed technical information on the flaw.
0000071
163 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-62948 OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases throug… https://www.cve.org/CVERecord?id=CVE-2026-62948 ----- Traducción: CVE-2026-62948 Ope… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑62948 in OpenWrt, noting that odhcpd writes the DHCPv6 client FQDN into /tmp/odhcpd.leases, but offers no PoC, patch, or exploitation evidence.
0000049
92 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-62948 OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases throug… https://www.cve.org/CVERecord?id=CVE-2026-62948
Post summary
The message references CVE‑2026‑62948, noting a post‑version‑25.12.5 flaw where odhcpd logs DHCPv6 FQDN hostname to /tmp/odhcpd.leases, but offers no proof‑of‑concept, exploit, patch, or evidence of active exploitation.
00000697
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	openwrt	openwrt	-	-	-

Explore more

Back to dashboard openwrt CVEs openwrt vulnerabilities

What researchers are saying

CVE-2026-62948

BT Haberler[verified]@BTHaberlerPatch

An official patch for CVE‑2026‑53921 has been released, along with fixes for two additional CVEs; routers without stack protection or ASLR face realistic exploitation risk and should update to the latest OpenWrt release.

SecureChap[verified]@SecureChapPoC

The post discloses a severe stack buffer overflow in OpenWrt’s odhcpd, provides public Python PoCs that exploit it, confirms no current in‑the‑wild attacks, and offers detailed technical information on the flaw.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑62948 in OpenWrt, noting that odhcpd writes the DHCPv6 client FQDN into /tmp/odhcpd.leases, but offers no PoC, patch, or exploitation evidence.

CVE@CVEnewDisclosure

The message references CVE‑2026‑62948, noting a post‑version‑25.12.5 flaw where odhcpd logs DHCPv6 FQDN hostname to /tmp/odhcpd.leases, but offers no proof‑of‑concept, exploit, patch, or evidence of active exploitation.