Browse all 35 CVE security advisories affecting OpenWRT. AI-powered Chinese analysis, POCs, and references for each vulnerability.
OpenWRT serves as a Linux-based firmware alternative for embedded networking devices, primarily used to extend router functionality and custom networking solutions. Historically, vulnerabilities have included remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from web interface components and default configurations. The project maintains a relatively low CVE count compared to commercial alternatives, with current vulnerabilities primarily affecting specific packages rather than the core system. While no major security incidents have been widely documented, the project's open nature allows for rapid vulnerability identification and patching, though users must remain vigilant with updates to mitigate risks associated with third-party package installations.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-55606 | odhcpd: Stack buffer overread via DUID length endianness mismatch in memcmp() — odhcpd CWE-126 | 6.5 | Medium | 2026-10-23 |
| CVE-2026-53918 | odhcpd DHCPv6 IA dangling first pointer use-after-free — odhcpd CWE-416 | 8.8 | High | 2026-10-23 |
| CVE-2026-53920 | odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure — odhcpd CWE-125 | 8.7 | High | 2026-10-23 |
| CVE-2026-53921 | odhcpd: Stack buffer overflow in DHCPv6 IA reply serialization (2 independent sites) — odhcpd CWE-121 | 9.8 | Critical | 2026-10-23 |
| CVE-2026-53922 | odhcpd: pre-auth remote DoS via size_t underflow in dhcpv6_ia_handle_IAs (stack BOF, canary-terminated) — odhcpd CWE-121 | 6.5 | Medium | 2026-10-12 |
This page lists every published CVE security advisory associated with OpenWRT. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.