A Critical OpenWrt DHCPv6 Flaw Exposes Millions of Devices to Root Access Attacks
Millions of internet-connected devices are vulnerable to a critical security flaw that could allow unauthenticated attackers to run code as root, thanks to an OpenWrt DHCPv6 vulnerability. The issue was discovered by a researcher and has already been patched by the OpenWrt project, but it’s unclear how many devices have yet to receive the update.
The OpenWrt project provides a custom Linux distribution for embedded devices such as routers, switches, and security cameras. These devices rely on DHCP (Dynamic Host Configuration Protocol) to obtain their IP addresses from a network server. However, in this case, the vulnerability lies in the way OpenWrt handles DHCPv6, a newer version of the protocol that provides stateful autoconfiguration for IPv6 networks.
When an attacker sends a malicious DHCPv6 packet to a vulnerable device, they can exploit the flaw and gain root access to the system. This is a particularly concerning issue because many devices rely on their manufacturer’s default settings or do not receive timely security updates. In other words, millions of internet-connected devices are potentially exposed to this vulnerability.
To understand how the attack works, consider that DHCPv6 typically requires authentication before allowing an attacker to obtain a new IP address. However, in this case, the flaw allows attackers to bypass this check and gain access to sensitive areas of the device’s configuration. The attacker can then use this access to install malicious software or modify system settings, effectively turning their device into a compromise.
The scope of this vulnerability is significant because OpenWrt is widely used on various devices, including routers from major manufacturers such as Netgear and Linksys. Moreover, many organizations rely on these devices for network connectivity and security. The potential for exploitation is considerable, especially considering the ease with which attackers can craft malicious DHCPv6 packets.
The takeaway from this vulnerability is clear: device manufacturers and users must prioritize timely updates to their systems and pay attention to known vulnerabilities. By staying informed about the latest threats and keeping software up-to-date, individuals and organizations can minimize their exposure to security flaws like this one.
Source: The Hacker News — 2026-07-28