Versie 24.10.8 van OpenWrt is uitgekomen. OpenWrt is alternatieve opensourcefirmware voor een groot aantal verschillende routers en embedded devices. Door middel van het apk-packagemanagementsysteem is er de mogelijkheid om zelf te bepalen wat de router allemaal wel en niet kan. Ook op GoT zijn er diverse mensen actief mee bezig: zie daarvoor dit topic. Bijwerken van de versie kan met een Attended Sysupgrade, handmatig met een voorgecompileerde firmwareversie van het apparaat dat je gebruikt of compileer je eigen variant met de firmwareselectie. Versie 24.10 is inmiddels EOL en ontvangt alleen nog beveiligingsupdates.
Security fixesThis release fixes several remotely triggerable vulnerabilities in core network services that are enabled by default. Updating is strongly recommended.
- odhcpd (DHCPv6/DHCPv4/RA server, enabled by default): multiple vulnerabilities reachable by a network-adjacent, unauthenticated attacker were fixed:
- CVE-2026-53921 (Critical): stack buffer overflow in the DHCPv6 IA reply serialization, triggerable with crafted DHCPv6 REQUEST packets. GHSA-7fwx-hhrg-3496
- Reconfigure-Accept stack buffer overflow (High, no CVE assigned): the Reconfigure-Accept reply block wrote 36 bytes into the response buffer without checking the remaining space, leading to a pre-auth out-of-bounds write. GHSA-q6wx-p68j-chp9
- CVE-2026-53918 (High): use-after-free through a dangling first-lease pointer in the DHCPv6 IA handler. GHSA-44ff-jcwh-wgc2
- CVE-2026-53920 (High): stack memory disclosure via a truncated DHCPv6 IA_NA/IA_PD option. GHSA-p769-5v73-pc4f
- CVE-2026-53922 (Moderate): pre-auth denial of service via a size_t underflow in DHCPv6 IA handling. GHSA-7hcw-g2jh-pqv5
- Zero-length CLIENT_ARCH option (Moderate, no CVE assigned): stack buffer over-read, and an unaligned read that crashes on strict-alignment targets. GHSA-7x9h-5mxm-jg3f
- NDP hop-limit spoofing (Moderate, CVSS 5.4, no CVE assigned): the NDP relay accepted IPv6 Neighbor Solicitations with a hop limit other than 255 (RFC 4861 violation), letting an off-link attacker spoof NS packets through the relay. Only relevant when the NDP relay is enabled. GHSA-qvg7-9jf5-wgjc
- odhcpd / LuCI stored XSS: CVE-2026-62948 (Critical): an unauthenticated DHCPv6 client could inject lease-file lines through a crafted FQDN hostname, resulting in stored cross-site scripting on the LuCI DHCPv6 leases status page. Fixed by escaping client hostnames in the lease state file. GHSA-hhmc-92hw-535f
- uhttpd (web server, serves LuCI): three HTTP request smuggling issues on keep-alive connections were fixed:
- CVE-2026-55614 (High): case-sensitive Transfer-Encoding matching. GHSA-mcfg-c4r7-pjpf
- CVE-2026-55612 (High): invalid chunk-length state reset. GHSA-p55c-rmhc-qfm5
- CVE-2026-55613 (Moderate): ubus POST body parse-error desync. GHSA-wgwp-64hh-f52p
- In addition uhttpd received hardening without an assigned CVE: a one-byte overflow in
uh_urldecode(), an off-by-one out-of-bounds read inuh_b64decode(), constant-time password comparison and stricter handling of$p$crypt-hash entries in the authentication realm.- rpcd: ACL bypass through symlinks (High): the
fileplugin matched ACL grants against the textual path but then followed symlinks unchecked, so a symlink inside an ACL-covered directory let a limited account read or write arbitrary root-owned files. The path is now re-resolved and re-authorized for every operation that dereferences the final component. GHSA-q5gr-86pq-vvwr- cgi-io (file upload/download helper used by LuCI, installed by default with LuCI):
- CVE-2026-62947 (Moderate): ACL bypass and arbitrary root file read — the download and exec paths were checked against the ACL before being canonicalized, so path traversal let an authenticated user with wildcard read permission read any root-readable file (e.g.
/etc/shadow). GHSA-jw5r-xhf5-2xcq- Use-after-free (Moderate, no CVE assigned): decoding malformed percent-encoded POST field data could use freed memory. GHSA-wvhq-qmwj-grj2
- LuCI (web interface): several issues in LuCI modules and applications were fixed. The privilege-escalation issues only apply if the affected app is installed and a limited (delegated) account with the relevant ACL exists:
- luci-app-ddns (High): the ucode status backend passed DDNS UCI values such as
lookup_host,dns_serverand the section name tosystem()as an unquoted shell string, so anyone able to write DDNS configuration could execute commands as root. The invocations now use the array form ofsystem(). GHSA-32r4-3wh2-qvq3- luci-app-samba4 (High): the read ACL granted exec permission for
smbdin general rather than onlysmbd -V, allowing read-only accounts to run arbitrary commands as root. GHSA-vx64-mmp7-h36c- luci-app-upnp (High): stored XSS — an unauthenticated LAN client can inject JavaScript through a UPnP port-mapping description, which the underlying daemon does not sanitize. The description is now HTML-escaped. GHSA-8v49-6387-7f89
- luci-mod-status (High): stored XSS via a DHCP/DHCPv6 lease hostname shown in the lease status tables. Together with the odhcpd fix above this closes the injection path from an unauthenticated DHCP client into the LuCI admin UI. GHSA-686p-p8p9-x6fh
- luci-base: the dispatcher now escapes the URL path and user name when logging, so crafted login requests can no longer pollute the system log.
- The LuCI rpcd ACL files were adjusted for the symlink-aware rpcd ACL check mentioned above, so that
/procpaths that are symlinks (such as/proc/mounts) keep working.- umdns (mDNS responder): CVE-2026-55492 (Moderate, CVSS 6.5): an unauthenticated attacker on the local network segment could flood the daemon with unique mDNS records; the unbounded cache exhausted the heap and took the whole device into out-of-memory. Fixed by bounding the cache size and clamping hostile TTLs. GHSA-jg8f-fhfw-jg46
- ead (Emergency Access Daemon): CVE-2026-55490 (Moderate): an integer underflow in
handle_send_a()allowed an unauthenticated attacker on the local segment to crash the daemon with a single crafted packet. GHSA-9558-77jp-g3fw- hostapd / wpa_supplicant: the fixes from upstream hostap security advisory 2026-1 were applied. Missing validation of multi-link (MLO / IEEE 802.11be) information in received Management frames could terminate the process or corrupt a small amount of memory; the frames need neither authentication nor user interaction. GHSA-3hj7-gj5w-h68m
- dropbear (SSH): security fixes from upstream 2026.90 were backported:
- CVE-2019-6111: a malicious server could make the
scpclient overwrite unexpected local files (missing OpenSSH patch). Note the accompanying upstream behaviour change:scp -ris now rejected when the target directory already exists.- CVE-2026-35385:
scpdid not clear setuid/setgid bits on received files.- An authenticated user could bypass an
authorized_keysforced_commandoption when dropbear runs with-t;authorized_keysis now opened non-blocking (local denial of service via special files); and aclose()on a file descriptor obtained from an out-of-bounds read was fixed.- musl libc: backport of the upstream fixes for CVE-2026-6042 (algorithmic-complexity denial of service in
iconv) and CVE-2026-40200 (stack corruption inqsortwith sufficiently large inputs).- OpenSSL: update to 3.0.21, fixing multiple security vulnerabilities (CVE-2026-45447, CVE-2026-34182, CVE-2026-45445, CVE-2026-7383, CVE-2026-9076, CVE-2026-34180, CVE-2026-42766, CVE-2026-42770, CVE-2026-45446).
- Linux kernel: update to 6.6.144, pulling in the upstream 6.6.142, 6.6.143 and 6.6.144 stable releases, which fix multiple security vulnerabilities.
- dnsmasq: update to 2.93, which carries the security fixes that were backported into 2.90 in the previous release (CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892, CVE-2026-4893 and CVE-2026-5172) plus further upstream fixes.
In addition, the
packagesfeed shipped with this release moved a number of optional packages to newer upstream versions that contain security fixes, among them curl (8.12.1 to 8.19.0), expat (2.7.4 to 2.8.2), BIND (9.20.23 to 9.20.26), PHP 8 (8.3.29 to 8.3.32), Tor (0.4.8.22 to 0.4.9.10), unbound (1.24.2 to 1.25.1), lighttpd (1.4.82 to 1.4.85), haproxy (3.0.19 to 3.0.25) and rsync (3.4.2 to 3.4.3). collectd also received a fix for a use-after-free in the ping plugin. These packages are not part of the default images — you have to update the installed packages on your device to receive them.Beyond the issues listed above, this release fixes a number of further security and robustness problems in odhcpd, odhcp6c, rpcd and uhttpd for which no CVE number or dedicated advisory was assigned. We strongly recommend upgrading to the latest OpenWrt release and installing all available package updates.
:strip_exif()/i/2004585566.png?f=thumbmedium)