tc4dy/CVE-2026-53921-PoC-Exploit
PoC files
7 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a full weaponized exploit for CVE-2026-53921, a stack buffer overflow in OpenWrt's odhcpd DHCPv6 daemon. It includes exploit.py, which crafts malicious DHCPv6 packets with shellcode to achieve remote code execution as root, and a README.md describing the vulnerability and usage.
Backdoor review
No backdoor observed in reviewed code
The repository contains a disclosed exploit for CVE-2026-53921, a stack buffer overflow in OpenWrt's odhcpd. The exploit.py script sends crafted DHCPv6 packets to trigger the overflow and deliver shellcode (reverse or bind shell) to the target. It also includes post-exploitation features (persistence, log clearing) that act on the target. All behavior is consistent with the documented exploit functionality; no concealed or misrepresented actions targeting the operator or unrelated systems were found.
Classification basis and observed behavior
Classification basis
The artifact contains exploit.py, which is explicitly described as a 'Full weaponized exploit' in the README. The code constructs and sends malicious DHCPv6 packets with shellcode to trigger a stack buffer overflow and achieve remote code execution, which is the definition of an exploit.
README.md:178-181exploit.py:292-318exploit.py:515-567Requirements
- Attacker must have IPv6 connectivity to the target and the target must have UDP port 547 (DHCPv6) open.
README.md:88-97 - The target must be running a vulnerable version of odhcpd (before commit e432dd6) or OpenWrt (< 24.10.8 or < 25.12.5).
README.md:143-150 - The exploit script requires root privileges to craft raw IPv6 packets.
exploit.py:31-32
Observed behavior
- Sends crafted DHCPv6 Request packets containing 5 or more IA_NA options or 22 or more IA_PD options to overflow a 512-byte stack buffer in odhcpd.
exploit.py:292-318exploit.py:320-347 - Embeds architecture-specific shellcode (MIPS reverse/bind, ARM reverse/bind) into the overflow payload to execute arbitrary commands on the target.
exploit.py:79-128exploit.py:130-179exploit.py:181-233exploit.py:235-248 - Starts a listener to receive a reverse shell or connect to a bind shell after exploitation.
exploit.py:411-468 - Supports post-exploitation actions including installing a cron backdoor for persistence and clearing system logs.
exploit.py:470-504
Behaviors behind the backdoor verdict
Observables
- Shellcode
- MIPS and ARM reverse/bind shell shellcode embedded in exploit.pyThe shellcode is the disclosed payload for the CVE-2026-53921 exploit, intended to execute on the target device.
exploit.py:79-248 - Post-Exploitation
- Persistence installation and log clearing functions in exploit.pyThese functions (install_persistence, clear_logs) act on the exploited target via the established shell, consistent with the documented exploit features.
exploit.py:470-504
What the analysis did not establish
- The evidence packet does not include the verifier.py script mentioned in the README, only its description.
- The evidence packet does not include the binary file (53921.png) or other non-text files from the repository.
- The CVE record for CVE-2026-53921 was absent from the acquired CVEList V5 dataset.
- The CVE-2026-53921 record was absent from the acquired CVEList V5, so the exploit's claimed CVE association could not be independently verified.
- One non-text media file (53921.png) and three unclassified files were not inspected; they are unlikely to contain executable backdoor logic.
- The ARM shellcode appears to be placeholder/non-functional (e.g., arm_reverse_shell contains repetitive register moves without syscall instructions), but this does not constitute a backdoor.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.