OpenWrt's newest 24.10 service release patches a critical pre-auth DHCPv6 overflow plus LuCI, uhttpd, and dropbear fixes — here's the operator's sysupgrade drill, and why 24.10 users should plan the move to 25.12.

Your router is the one Linux box you never think about — and the one with the biggest network-facing attack surface in your house. This week the OpenWrt project shipped 24.10.8, a security maintenance release for the 24.10 stable series, and its own words are blunt: the release "fixes many security issues, several of them remotely triggerable in network services that are enabled by default," and upgrading is strongly recommended. Here's what matters and how to handle it like an operator.

The Bug That Should Get Your Attention

The headliner is in odhcpd, the DHCPv6/DHCPv4/RA server that ships enabled by default on every OpenWrt device:

  • CVE-2026-53921 (Critical): a stack buffer overflow in DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets by a network-adjacent, unauthenticated attacker. Translation: anyone who can send packets to your LAN — a compromised IoT gadget, a guest device, your ISP's segment on some topologies — can attack the daemon that hands out your network configuration.
  • CVE-2026-62948 (Critical): a stored cross-site scripting chain where an unauthenticated DHCPv6 client injects lease-file lines through a crafted FQDN hostname, and the LuCI DHCPv6 leases page renders them. Your router's admin UI becomes the payload's stage.

The supporting cast is just as telling: three HTTP request-smuggling issues in uhttpd (the web server behind LuCI), an ACL bypass through symlinks in rpcd that let a limited account read or write arbitrary root-owned files, stored XSS via UPnP port-mapping descriptions, command injection as root in luci-app-ddns, the upstream hostap 2026-1 Wi-Fi fixes, dropbear SSH backports, plus OpenSSL 3.0.21, dnsmasq 2.93, and a kernel bump to 6.6.144.

Notice the pattern: almost every critical item sits in a service that is on by default. That's the router threat model — your attack surface is whatever the firmware runs out of the box, and OpenWrt's default surface is generous because a router has to serve the network.

The Flash Drill

Routers don't have unattended-upgrades. You are the patch pipeline. The drill:

  1. Check what you're running. SSH in and run cat /etc/openwrt_release, or glance at the LuCI overview page. Anything below 24.10.8 is exposed.
  2. Back up the config first. LuCI → System → Backup / Flash Firmware → Generate archive. Store the tarball off the device. If the flash goes sideways, this file is the difference between a five-minute recovery and retyping your VLANs from memory.
  3. Flash via sysupgrade. In LuCI, System → Backup / Flash Firmware → Flash new firmware image, upload the 24.10.8 image for your target (grab it from the firmware selector at firmware-selector.openwrt.org with version=24.10.8), keep settings checked. CLI people: sysupgrade -v /tmp/openwrt-24.10.8-*.bin — the device reboots itself.
  4. Verify the running version. After the reboot, re-check /etc/openwrt_release and confirm services came up: logread | grep odhcpd. A flashed-but-not-verified router is the embedded twin of the installed-but-not-booted kernel problem.
  5. Update installed packages too. The release notes are explicit: packages like curl, expat, Tor, unbound, and haproxy moved to versions with security fixes, but they're not in the default image — run your package updates to receive them.

The Real Deadline: 24.10 Is on Borrowed Time

Here's the part that matters more than any single CVE: the 24.10 series is in security maintenance only, with end of life projected for September 2026 — which has already passed. The project officially recommends migrating to OpenWrt 25.12. This release is a grace-period security drop for stragglers, not a reason to stay.

So treat 24.10.8 as two things at once: tonight's patch (flash it), and your cue to schedule the 25.12 migration. Direct sysupgrade from 24.10 to 25.12 is supported and expected to be smooth on most hardware — but check the release notes for your target's known issues before you commit, and never migrate a remote router you can't physically reach without a tested rollback plan.

The Takeaway

Routers get compromised through boring services — DHCP, DNS, the admin web UI — not exotic zero-days. OpenWrt 24.10.8 is a textbook case: a critical DHCPv6 overflow plus a web-UI injection chain, all in default-on components. The fix is thirty minutes of your evening and one config backup. The harder task is the migration you're now overdue for. Flash tonight, plan 25.12 this weekend.

Sources: OpenWrt v24.10.8 release notes — https://github.com/openwrt/openwrt/releases/tag/v24.10.8 ; OpenWrt firmware selector — https://firmware-selector.openwrt.org ; OpenWrt sysupgrade documentation — https://openwrt.org/docs/guide-user/installation/sysupgrade.cli