CVE-2026-55606Medium· 6.5▾ Sunlitodhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size par…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detection at dhcpv6.c:720 uses a network-byte-order DUID length value directly as the memcmp() size parameter. On little-endian hosts, this causes memcmp() to read far beyond the stack buffer — a single unauthenticated DHCPv6 packet triggers a 2560-byte overread from a 128-byte buffer. At time of publication, there are no publicly available patches.
odhcpd <= 25.12Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-53920High· 8.7odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure
CVE-2026-53921Critical· 9.8odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites)
CVE-2026-53918High· 8.8odhcpd DHCPv6 IA dangling first pointer use-after-free
CVE-2026-53922Medium· 6.5odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt
CVE-2026-55897High· 8.8luci-app-advanced-reboot is a LuCI (web interface) application for OpenWrt that provides a way to reboot your router into an alternative firmware partition or perform reboot operations directly from the web UI
CVE-2026-55159High· 8.8luci-app-adblock-fast a WebUI for fast, lightweight DNS-based ad-blocker for OpenWrt that works with dnsmasq, smartdns, or unbound