CVE-2026-53921-PoC-Exploit

CVE-2026-53921 – odhcpd スタックオーバーフロー ⚠️ 教育および許可されたテスト目的のみ。無許可での使用は違法です。 📖 脆弱性概要 CVE-2026-53921 は、OpenWrt の odhcpd デーモン（既定の DHCPv6/DHCPv4/RA サーバー）における深刻なスタックバッファオーバーフロー です。 🔍 動作の仕組み この脆弱性は odhcpd の DHCPv6 メッセージ処理コード、具体的には buildia 関数と dhcpv6iahandleIAs 関数に存在します。 技術的詳細 1. 根本原因 このバグは、DHCPv6 Reply...

CVE-2026-53921

🚨 CVE-2026-53921 - odhcpd OpenWrt odhcpd 中的严重基于栈的缓冲区溢出 一个远程未认证的基于栈的缓冲区溢出漏洞，可能允许以root 权限 执行远程代码（RCE） 。 📖 概述 ⚡ 描述 CVE-2026-53921 是一个影响 OpenWrt DHCPv6 服务器（odhcpd） 的严重基于栈的缓冲区溢出 漏洞。 远程未认证的攻击者可以发送特制的 DHCPv6 REQUEST 数据包来触发内存破坏，进一步可能导致以 root 权限 执行任意代码 或引发拒绝服务（DoS） 。 由于 odhcpd 以 root 权限...

LuCI DHCPv6 Cross Site Scripting

OpenWrt LuCI suffers from a cross site scripting vulnerability. An unauthenticated adjacent-network attacker can inject malicious HTML/JavaScript via DHCPv6 Client FQDN option 39. The hostname is stored by odhcpd and rendered unsafely via innerHTML in LuCI status tables. Exploit Title: LuCI DHCPv...

CVE-2026-62948

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6 and statefileswritestate4 without escaping, allowing newline injection of forged lease lin...

CVE-2026-62948

OpenWrt odhcpd/LuCI vulnerability CVE-2026-62948: Before 25.12.5, the DHCPv6 client FQDN option 39 hostname is written into /tmp/odhcpd.leases without escaping, allowing newline injection of forged lease lines. LuCI displays these lines in the Active DHCPv6 Leases page via rpcd-mod-luci getDHCPLe...

CVE-2026-62948 OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, odhcpd writes a DHCPv6 client FQDN option 39 hostname into /tmp/odhcpd.leases through src/statefiles.c statefileswritestate6 and statefileswritestate4 without escaping, allowing newline injection of forged lease lin...

PT-2026-60254

Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 25.12.5 Description The odhcpd component writes a DHCPv6 client FQDN option 39 hostname into the /tmp/odhcpd.leases file via the statefiles write state6 and statefiles write state4 functions without proper escaping...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

Design/Logic Flaw

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17867

CVE-2017-17867 concerns Inteno IOPSYS devices (2.0–3.14 and 4.0) where remote authenticated users can execute arbitrary OS commands by manipulating the leasetrigger field in the odhcpd config via an SMB share, due to insufficient protection of OpenWrt config (not using /etc/uci-defaults). Connect...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...