OpenWrt 25.12.5 Security Update: Multiple Vulnerabilities in odhcpd, uhttpd, LuCI

Vulnerability Overview OpenWrt 25.12.5 addresses multiple security vulnerabilities, primarily affecting core network services. These vulnerabilities include stack buffer overflows, denial of service (DoS), arbitrary file reads, and command injection. Affected Components odhcpd (DHCPv6/DHCPv4RA server): Multiple vulnerabilities, including stack buffer overflow, denial of service, and heap overflow. odhcpd / LuCI Stored XSS: Unauthenticated DHCPv6 clients can inject lease file lines by providing crafted FQDN hostnames. uhttpd (Web server): Multiple vulnerabilities, including invalid chunk length state resets, case-sensitive transfer encoding matching, and POST body parsing errors. cgi-io: ACL Bypass / Arbitrary File Read: A path traversal vulnerability allows authenticated users to read any readable file using wildcards. LuCI Web Interface: Multiple vulnerabilities, including command injection, pre-authentication root command execution, and automatic login command execution. ead (Emergency Access Daemon): Integer underflow leading to pre-authentication denial of service. Linux Kernel: Multiple vulnerabilities, including integer underflow and denial of service. OpenSSL: Multiple vulnerabilities, including integer overflow and denial of service. musl libc: Multiple vulnerabilities, including integer overflow and denial of service. dropbear (SSH): Multiple vulnerabilities, including integer overflow and denial of service. Remediation Upgrade to OpenWrt 25.12.5: It is strongly recommended to upgrade to the latest version to patch all known vulnerabilities. Install all available package updates: Ensure all available package updates are installed to further harden the system. Vulnerability Details odhcpd (DHCPv6/DHCPv4RA server) CVE-2026-53921 (Critical): Stack buffer overflow in DHCPv6 IA reply serialization, triggerable via crafted DHCPv6 REQUEST packets. CVE-2026-53918 (High): Use-after-free condition in DHCPv6 IA processing. CVE-2026-53920 (High): Stack memory corruption caused by truncated DHCPv6 IA_NA/IA_PD options. CVE-2026-53922 (Moderate): Pre-authentication denial of service caused by underflow in the service. CVE-2026-55606 (Moderate): Stack buffer overflow due to byte order mismatch in DUID length bytes. odhcpd / LuCI Stored XSS CVE-2026-55612 (Critical): Unauthenticated DHCPv6 clients can inject lease file lines by providing crafted FQDN hostnames. uhttpd (Web server) CVE-2026-55612 (High): Invalid chunk length state reset. CVE-2026-55614 (High): Case-sensitive transfer encoding matching. CVE-2026-55613 (High): POST body parsing error. cgi-io: ACL Bypass / Arbitrary File Read CVE-2026-55615 (Critical): Path traversal vulnerability allows authenticated users to read any readable file using wildcards. LuCI Web Interface CVE-2026-55616 (Critical): Command injection allows delegated users to execute commands with root privileges. CVE-2026-55617 (High): ACL exposure of via allows delegated users to execute commands with root privileges. CVE-2026-55618 (High): Delegated users can execute commands with root privileges via newline-separated cron entries. CVE-2026-55619 (High): ACL read access allows authenticated root command execution via permissions. CVE-2026-55620 (High): Authenticated UCI users can execute commands to run with root privileges. CVE-2026-55621 (High): Unauthenticated LAN clients can inject JavaScript via UPnP port mapping descriptions. CVE-2026-55622 (High): Stored XSS via DHCPv6 lease hostname (FQDN) displayed in the status table. CVE-2026-55623 (High): Crafted LuCI login usernames can inject arbitrary IPs into the banIP resolver, causing incorrect addresses to be blocked. ead (Emergency Access Daemon) CVE-2026-55624 (Moderate): Integer underflow in allows pre-authentication denial of service. Linux Kernel CVE-2026-55625 (Moderate): Integer underflow in allows pre-authentication denial of service. OpenSSL CVE-2026-55626 (Moderate): Integer overflow in allows pre-authentication denial of service. musl libc CVE-2026-55627 (Moderate): Integer overflow in allows pre-authentication denial of service. dropbear (SSH) CVE-2026-55628 (Moderate): Integer overflow in allows pre-authentication denial of service. Known Issues Zyxel EX5601-T0: The WAN interface has been renamed from to ; check and update network configurations after upgrading. Pixel 10 Phone: Issues connecting to WiFi 6 Access Points protected with WPA3. 802.11r Fast Transition (FT): Connection issues with certain WiFi clients when using WPA3. SQM CAKE MQ: Throughput may unexpectedly decrease in certain configurations following the scheduler fix. Upgrade Guide Upgrading from 24.10 to 25.12: Generally transparent on most devices; configuration data should remain intact or be correctly translated. Upgrading from 23.05 or earlier to 25.12: Not supported; manual backup and restoration of configurations are required. Cron Log Level: Set to 7 in within ; the default value is 7. BananaPi BPI-R4: Interface is renamed to or , and interface is ren

Goal Reached Thanks to every supporter — we hit 100%!

OpenWrt 25.12.5 Security Update: Multiple Vulnerabilities in odhcpd, uhttpd, LuCI

More from this source